Platform API error

key_revoked

key_revoked is the OneLifeVibe Platform API error returned with HTTP 401 when a request uses an API key that was revoked in the console.

Updated November 6, 2026

HTTP status: 401
Code: key_revoked
API: Platform API v1

Returned when

The key was revoked in the console.

What to do

Create a new key in the console and deploy it; a revoked key never works again.

Example answer

HTTP/1.1 401
content-type: application/json

{
  "error": {
    "code": "key_revoked",
    "message": "This API key has been revoked."
  }
}

Related errors

key_expired The API key is past its expiry date.
invalid_credentials The API key is not valid.

What it means

key_revoked is the error code the OneLifeVibe Platform API returns with HTTP 401 when a request presents an API key that was revoked in the console. The key is treated as unusable, so the request is rejected.

The response body contains an error object with error.code, error.message, and error.hint. The code is key_revoked, and the message can read This API key has been revoked. Error codes are stable; match on error.code, never on the message text.

Why you are seeing it

The key was revoked in the console. Once that happens, every request that uses the key returns key_revoked with HTTP 401. Revocation is not a temporary state: a revoked key never works again.

If a deployed service or scheduled job still holds the old key, its next call to the Platform API will hit this error. A failing request that previously worked is a sign to check which credential the deployment is sending.

How to fix it

Create a new key in the console and deploy it. Replace the revoked key everywhere it is stored, then retry the request with the new key. The old key cannot be restored or reused.

After deploying the new key, confirm that the failing request now authenticates. Do not keep retrying with the revoked key; it will never work again. If several services or environments used the old key, update each one.

Handling it in code

Read error.code from the response and compare it to key_revoked. Because codes are stable but messages are not the contract, branch on the code and leave message text for logs or display only.

Treat key_revoked as a credential configuration failure, not a transient one. Stop retrying the same key, surface the failure to the operator, and replace the key. key_expired and invalid_credentials are related codes; handle each by its own code path.

Questions

What HTTP status code comes with key_revoked?

key_revoked is returned with HTTP 401. The response includes an error object with code, message, and hint fields.

Can a revoked API key be used again?

No. A revoked key never works again. Create a new key in the console, deploy it, and retry with the new key.

Should I match on the error message or the error code?

Match on error.code. Codes are stable, while the message is not the contract; check for key_revoked and handle related codes such as key_expired and invalid_credentials separately.

Keys, plans and usage live in the console: rotate keys, add webhook endpoints, see the last 30 days.

Open the console Plans

Written from the OneLifeVibe tool registry and platform configuration, and checked automatically before publishing. Something wrong? Tell us.