Delete an access key

Deleting an access key retires it for good. Within 60 seconds, everywhere, STRG stops accepting it - through the S3 API, presigned URLs included, through the MCP server and through this API - so whatever was holding it can no longer reach your storage.

• Any of your access keys can be deleted, whatever its access. The key making the request needs only Manage access keys through the API, which means a key limited to one bucket can delete a key for all buckets.
• The calling key can delete itself. The request succeeds with 204, and the key then stops working within 60 seconds, like any other deleted key.
• There is no confirmation step: the key is deleted by the time the request is answered.

danger

A deleted key cannot be restored. The same access can be given again as a new key - but it comes with a new id and a new secret, so every client that used the old one needs the new one.

When you'd use it

• Rotating credentials. A deploy pipeline creates a fresh key, rolls it out to its servers, and then deletes the old one, so a key never stays in use for longer than one rotation.
• Cleaning up after a job. A CI run that created a short-lived key for a test bucket deletes it as its last step, leaving nothing behind for anyone to find later.
• Responding to a leak. A secret that turned up in a log or a public repository can be shut off in a single request, without waiting for anyone to reach the dashboard.
• Tidying up. A script that lists your keys can delete the ones no application uses any more.

Request

DELETE /v1/access-keys/{id} HTTP/1.1
Host: api.strg.com
Authorization: Bearer <access key id>:<secret>

Path parameters

The key to delete is named in the path.

Name	Type	Required	Description
id	string	Yes	The access key id to delete, as an S3 client sends it - the id field of List access keys and Get an access key

Request headers

The one header that matters is the key the request acts as.

Name	Required	Description
Authorization	Yes	Bearer <access key id>:<secret> of an active key holding Manage access keys through the API

The request has no body.

Response

A successful delete answers 204 No Content, with no body and Cache-Control: no-store.

HTTP/1.1 204 No Content
Cache-Control: no-store

A delete is not repeatable: the same request again answers 404 not_found, since the key no longer exists. So when a delete is retried because its first answer never arrived, a 404 on the retry means the first one worked.

Errors

These are the answers this operation can give instead of 204, each an application/problem+json body whose shape Errors describes.

Status	code	When
401	unauthenticated	The Authorization header is missing or malformed, the key or secret is wrong, the calling key is deleted, or it does not hold Manage access keys through the API. One answer for all of them, with WWW-Authenticate: Bearer realm="strg.com"
404	not_found	Your account has no key with this id to delete: it was never created, it is another account's, it is already deleted, or it is one of the keys STRG manages for you - the dashboard's own key and the assistant's. detail is There is no such access key.
429	rate_limited	Too many requests for this key or from your address. Retry-After says how many seconds until the next attempt is welcome
500	internal_error	Something went wrong on our side. The same request a moment later is the way forward

Examples

Each example deletes the key STRGEXAMPLE7KQ2M4N9P, authenticating with the key in AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.

curl

curl -sS -X DELETE \
  -H "Authorization: Bearer $AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" \
  -w "%{http_code}\n" \
  https://api.strg.com/v1/access-keys/STRGEXAMPLE7KQ2M4N9P

This prints 204 once the key is deleted. For any other status, the error body is printed first, directly followed by the status.

Python (requests)

delete_access_key.py

import os

import requests

key_id = os.environ["AWS_ACCESS_KEY_ID"]
secret = os.environ["AWS_SECRET_ACCESS_KEY"]
target = "STRGEXAMPLE7KQ2M4N9P"

response = requests.delete(
    f"https://api.strg.com/v1/access-keys/{target}",
    headers={"Authorization": f"Bearer {key_id}:{secret}"},
)
if response.status_code == 204:
    print(f"Deleted {target}")
elif response.status_code == 404:
    print(f"{target} does not exist or is already deleted")
else:
    problem = response.json()
    raise SystemExit(f"{response.status_code} {problem['code']}: {problem['detail']}")

JavaScript (fetch)

delete-access-key.mjs

const keyId = process.env.AWS_ACCESS_KEY_ID;
const secret = process.env.AWS_SECRET_ACCESS_KEY;
const target = "STRGEXAMPLE7KQ2M4N9P";

const response = await fetch(`https://api.strg.com/v1/access-keys/${target}`, {
  method: "DELETE",
  headers: { Authorization: `Bearer ${keyId}:${secret}` },
});
if (response.status === 204) {
  console.log(`Deleted ${target}`);
} else if (response.status === 404) {
  console.log(`${target} does not exist or is already deleted`);
} else {
  const problem = await response.json();
  throw new Error(`${response.status} ${problem.code}: ${problem.detail}`);
}

Related

• REST API overview - authentication, errors and rate limits
• List access keys - where the id of a key to delete comes from
• Get an access key
• Create an access key
• Access keys - what a key is, its permissions and scope