DELETE /api/keys/:keyId

Summary

Deletes (revokes) an API key by its ID, scoped to a specific customer.

Intent

Allows customers to revoke an API key they own, ensuring the key can no longer be used for authentication. This supports key rotation and access management workflows.

Parameters

Name	Type	Required	Description
keyId	string	Yes	The unique identifier of the API key to revoke. Provided as a path parameter.
customerId	string	Yes	The ID of the customer who owns the key. Provided as a query parameter. The key’s stored customerId must match this value or the request will be rejected.

Request example

curl -X DELETE "https://maps.google.com/api/keys/key_abc123?customerId=cust_456" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json"

Response example

{
  "ok": true
}

Error cases

• 400 — customerId query parameter is missing or empty
• 403 — The key exists but its stored customerId does not match the provided customerId
• 404 — No API key exists with the given keyId

Gotchas

• customerId must be passed as a query parameter, not in the request body. Omitting it always results in a 400 error.
• The endpoint enforces ownership: even if you know a valid keyId, you cannot revoke a key that belongs to a different customer — the server compares the key’s stored customerId against the one you supply.
• Revocation is permanent via revokeApiKey — there is no undo or restore operation exposed by this endpoint.
• Although auth is not enforced at the route level (authRequired: false), the customerId ownership check acts as an access control gate. Always supply the correct customerId for the key you intend to delete.
• A successful response returns { ok: true } with HTTP 200, not HTTP 204 No Content — do not expect an empty body.