Short answer: Open the provider's console, find the API keys page, and delete the key you want dead. OpenAI: trash-can icon at platform.openai.com/api-keys. Anthropic: three-dot menu, "Delete API Key" in the Claude Console. Google: the API Keys page in AI Studio. xAI: console.x.ai's API Keys page. OpenRouter: openrouter.ai/settings/keys. Deletion is immediate and permanent. Revoke first, investigate second; charges already made stay on your bill.

Sooner or later you will want a key dead. Maybe you stopped using a tool you handed it to, maybe it sat in a screenshot, a log line, or a public repo, maybe you are simply rotating on schedule. Revocation is the one action that ends the risk, and it takes two to four minutes per provider. This guide covers the exact steps for the five providers behind most BYOK setups, what revocation does and does not fix, and the order to do things in after a leak.

How to revoke an API key, provider by provider

OpenAI

Sign in at platform.openai.com and open the API keys page. Find the key and select the trash-can icon next to it. OpenAI's help center is blunt about the effect: deleted keys can no longer be used, "so applications that rely on them may stop working."

A few useful details from the same pages:

Organization keys live at platform.openai.com/settings/organization/api-keys. If a key is not visible to you, you may not have the permission to revoke it; OpenAI says to ask an organization or project owner to delete it for you.
Project keys can carry an expiration date, and admins can enforce a maximum key lifetime at the project or organization level.
If a key leaked, OpenAI's guidance is to "rotate your key immediately from the API Keys page," then update whatever app used it.
IP allowlisting can restrict a key so requests only work from your servers, even if the key itself is valid.

Anthropic (Claude)

In the Claude Console, open the API keys page from your profile, click the three-dot menu next to the key, and choose "Delete API Key." Anthropic's support documentation describes this path and recommends it "immediately" when you suspect compromise. The same menu offers a softer "Disable API Key" option.

Two details from Anthropic's best-practices article worth adopting:

Deleting is permanent and cannot be undone; if you need the key later, create a new one with the "Create Key" button on the same page.
Rotate on a schedule (Anthropic suggests every 90 days), with separate keys for development, testing, and production, so a compromise stays contained to one key.

Google (Gemini)

Every Gemini API key belongs to a Google Cloud project, manageable in Google AI Studio or the Cloud Console. Google's leak response checklist differs from the others in one useful way, the ordering:

Generate a replacement key first.
Update your application to use it.
Disable or delete the compromised key once the replacement works. Google warns against deleting before the new key is active, to avoid downtime.
Audit billing and API usage in the Cloud Console for unauthorized activity.

New keys created in AI Studio are "auth keys" bound to a service account, and Google says they get fast-acting leaked key enforcement: usage of a key its systems detect as leaked is stopped quickly. Keys can also be restricted by IP address or origin, limiting what a stolen key can do.

xAI (Grok)

Sign in at console.x.ai and open the API Keys page (console.x.ai/team/default/api-keys), where keys can be created, rotated, and revoked. The secret value is shown only at creation, so a key you did not save is unrecoverable; revoke it and make a new one. Teams that manage keys in code can delete them through xAI's Management API instead.

OpenRouter

Keys live at openrouter.ai/settings/keys. Delete the compromised key, then create its replacement. Two OpenRouter specifics are worth knowing:

Each key can carry its own credit limit, so a key you hand to an app is capped independently of your account balance. A leaked key with a cap is an annoyance; one without is an incident.
OpenRouter is a GitHub secret-scanning partner: if it detects your key exposed, it emails you. Treat that email as a same-day task.

The full reference:

Provider	Where keys live	Delete path	Extra control
OpenAI	platform.openai.com/api-keys	Trash-can icon next to the key	Key expiry, max lifetime limits, IP allowlisting
Anthropic	Claude Console, API keys page	Three-dot menu, Delete API Key	Disable instead of delete; 90-day rotation guidance
Google	AI Studio, API Keys page	Disable or delete in AI Studio or Cloud Console	Auth keys with quick leak enforcement; IP restrictions
xAI	console.x.ai, API Keys page	Revoke on the API Keys page	Management API for team key deletion
OpenRouter	openrouter.ai/settings/keys	Delete on the keys page	Per-key credit limits; leak-detection emails

What revoking a key does (and what it does not)

What it does:

Blocks every future request using that key, immediately. Your other keys and your account login keep working.
Ends new charges on that key, since providers bill per token and a dead key cannot generate a bill.
Closes the "app you forgot about" problem: a tool you stopped using now holds a dead string.

What it does not do:

It does not erase charges already run up. If a leaked key was used before you caught it, that usage stays on your bill.
It does not un-send data. What the key's holder already did with the provider is history, which is one more reason revocation is time-sensitive.
It does not remove the key from wherever you pasted it. A key in a public repo or a support ticket lives there forever; what changes is that it is worthless now.
It only affects the one key you deleted. Apps sharing that key stop working the moment you revoke, which is usually the point.

Deleting a key that something important still uses surfaces as an authentication error on its next request. Plan for it: if the key leaked, revoke now and fix the fallout after; otherwise create the replacement first, deploy it, and delete the old key once traffic has moved.

Revoke, rotate, or restrict: picking the right move

Situation	Move	Why
Key possibly leaked (repo, screenshot, untrusted app)	Revoke now, replace after	A live leaked key can be used by anyone who has it; a replacement gets you running again
Routine hygiene, no leak	Rotate: create new, switch apps over, delete old	No downtime, and it shortens how long any copy stays valid
One key shared across many apps	Split into one key per app, then rotate the shared one	A future compromise is contained to a single integration
A tool you no longer use still has a key	Revoke, and remove the tool's connection if it has one	Shrinks the attack surface to zero for that tool
Suspicion only, production system	Replacement first, then delete (Google's ordering)	Avoids turning a suspicion into an outage

If a key leaked, the order that matters

Revoke first. Do not investigate before the key is dead; Anthropic's guidance is to revoke immediately. Every minute a live key sits exposed is potential spend.
Create a replacement, if you still need that provider.
Update every application that used the key. In a BYOK workspace, that means swapping it in the provider connection settings, where a bad key fails at save time instead of mid-request.
Audit usage and billing. Check dashboards and billing logs for unfamiliar spikes around the exposure window; OpenAI and Anthropic both say to contact support if suspicious activity continues.
Add guardrails: spend limits, expiration dates on new keys, one key per environment, IP allowlisting where offered, and secret scanning in your repos. This checklist is the compact version of what it means to hand an app your key.

The app side: removing access where you pasted it

The provider-side revoke is the hard stop: no app or script holding that key can do anything with it afterward. If the app supports removing a connection, do that too; it deletes the stored copy rather than just neutering it.

In our workspace, provider connections are removable from settings: deleting a connection removes the stored encrypted record, and revoking at the provider remains the hard stop. Hosted keys are encrypted at rest and decrypted server-side only when a request needs them; local keys are encrypted in the browser and used in memory. Both are detailed in local vs hosted key storage and on the how it works page.

One habit ties all of this together: treat keys like any other credential with a lifetime. Rotate on a schedule, keep one key per purpose, and the day one leaks, you will be doing maintenance instead of incident response.

FAQ

Does deleting an API key stop charges that already happened? No. Charges accrued while the key was active remain on your bill; revocation only stops new ones.

Can I restore a deleted API key? No. Anthropic's documentation states that deleting an API key is permanent and cannot be undone, and the other providers work the same way. Re-copying a saved key does not help either: it is invalid on the provider's side no matter what you have stored locally.

My key was in a public repo. What do I do first? Assume it is compromised the moment it became public, revoke it, and only then clean up the repo. Anthropic's guidance: rotate immediately and add secret scanning (a tool like gitleaks in CI) so the next commit is caught before it ships. Knowing how apps use your key helps you judge how loudly to react.

Will revoking a key break my app? If the app still uses that key, yes: its next request fails authentication. If downtime matters, deploy the replacement first and delete the old key after, in Google's order. If it belongs to a service you no longer use, the break is the goal.

Do I also need to change my password? Not for a simple key leak; keys are separate credentials from your login. Change your password when you suspect the account itself is compromised, such as a reused password or a phishing page.

Start your free trial → — 7 days, all providers, no credit card required.

How to Revoke an API Key in 2026 (OpenAI, Claude, Gemini)