curl --request DELETE \
--url https://api.gigstack.io/v2/users/me/scoped-api-keys/{keyId} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"operation_id": "<string>"
}
'const options = {
method: 'DELETE',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({operation_id: '<string>'})
};
fetch('https://api.gigstack.io/v2/users/me/scoped-api-keys/{keyId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/users/me/scoped-api-keys/{keyId}"
payload = { "operation_id": "<string>" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"key_id": "<string>",
"revoked": true,
"operation_id": "<string>"
},
"timestamp": 1
}Revoke only one authorized key with a persisted operation UUID
Integration note: Requires current personal identity and billing-account/per-key ACLs. API keys never manage credentials. Safe metadata only; private browser approval alone reveals a new secret once. Legacy keys remain valid; no forced migration. See API credentials.
Requires an active personal Firebase/MCP identity and current billing-account/per-key management authority. API keys, including legacy keys, cannot manage credentials. Readback contains metadata only, never stored tokens, secret-once browser execution data or reviewer challenges. Follow non-null next_cursor including empty pages. New routes do not inherit key scope permission.
curl --request DELETE \
--url https://api.gigstack.io/v2/users/me/scoped-api-keys/{keyId} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"operation_id": "<string>"
}
'const options = {
method: 'DELETE',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({operation_id: '<string>'})
};
fetch('https://api.gigstack.io/v2/users/me/scoped-api-keys/{keyId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.gigstack.io/v2/users/me/scoped-api-keys/{keyId}"
payload = { "operation_id": "<string>" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.delete(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"key_id": "<string>",
"revoked": true,
"operation_id": "<string>"
},
"timestamp": 1
}Authorizations
Authentication Method: HTTP Bearer token.
The runtime requires the literal Bearer prefix — a bare token in the
Authorization header is rejected with 401 unauthorized.
Header Format: Authorization: Bearer YOUR_API_KEY
Your API key is a JWT. Live keys operate on live data (livemode: true);
test keys operate on isolated test data (livemode: false).
Get your key at: app.gigstack.pro/settings?tab=api
Errors: credential failures are answered by the authentication layer with a raw
{ "message": … } body, not the standardized envelope — 401 for a missing, malformed or
expired token, 403 for a revoked key or a plan without API access. See the Unauthorized
and AuthForbidden responses.
Path Parameters
^[A-Za-z0-9_-]{1,128}$Query Parameters
^[A-Za-z0-9_-]{1,128}$Body
^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$