# Delete an access key

Deleting an access key retires it for good. Within 60 seconds, everywhere, STRG stops accepting
it - through the S3 API, presigned URLs included, through the MCP server and through this API - so
whatever was holding it can no longer reach your storage.

- **Any of your access keys can be deleted**, whatever its access. The key making the request needs
  only *Manage access keys through the API*, which means a key limited to one bucket can delete a
  key for all buckets.
- **The calling key can delete itself.** The request succeeds with `204`, and the key then stops
  working within 60 seconds, like any other deleted key.
- There is no confirmation step: the key is deleted by the time the request is answered.

**Danger:**

A deleted key cannot be restored. The same access can be given again as
[a new key](https://docs.strg.com/rest-api/create-access-key) - but it comes with a new id and a new secret, so every
client that used the old one needs the new one.

## When you'd use it

- **Rotating credentials.** A deploy pipeline creates a fresh key, rolls it out to its servers,
  and then deletes the old one, so a key never stays in use for longer than one rotation.
- **Cleaning up after a job.** A CI run that created a short-lived key for a test bucket deletes it
  as its last step, leaving nothing behind for anyone to find later.
- **Responding to a leak.** A secret that turned up in a log or a public repository can be shut
  off in a single request, without waiting for anyone to reach the dashboard.
- **Tidying up.** A script that lists your keys can delete the ones no application uses any more.

## Request

```http
DELETE /v1/access-keys/{id} HTTP/1.1
Host: api.strg.com
Authorization: Bearer <access key id>:<secret>
```

### Path parameters

The key to delete is named in the path.

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | Yes | The access key id to delete, as an S3 client sends it - the `id` field of [List access keys](https://docs.strg.com/rest-api/list-access-keys) and [Get an access key](https://docs.strg.com/rest-api/get-access-key) |

### Request headers

The one header that matters is the key the request acts as.

| Name | Required | Description |
| --- | --- | --- |
| `Authorization` | Yes | `Bearer <access key id>:<secret>` of an active key holding *Manage access keys through the API* |

The request has no body.

## Response

A successful delete answers `204 No Content`, with no body and `Cache-Control: no-store`.

```http
HTTP/1.1 204 No Content
Cache-Control: no-store
```

A delete is not repeatable: the same request again answers `404 not_found`, since the key no longer
exists. So when a delete is retried because its first answer never arrived, a `404` on the retry
means the first one worked.

## Errors

These are the answers this operation can give instead of `204`, each an
`application/problem+json` body whose shape [Errors](https://docs.strg.com/rest-api/overview#errors) describes.

| Status | `code` | When |
| --- | --- | --- |
| `401` | `unauthenticated` | The `Authorization` header is missing or malformed, the key or secret is wrong, the calling key is deleted, or it does not hold *Manage access keys through the API*. One answer for all of them, with `WWW-Authenticate: Bearer realm="strg.com"` |
| `404` | `not_found` | Your account has no key with this id to delete: it was never created, it is another account's, it is already deleted, or it is one of the keys STRG manages for you - [the dashboard's own key](https://docs.strg.com/access-keys#the-dashboards-own-key) and the assistant's. `detail` is `There is no such access key.` |
| `429` | `rate_limited` | Too many requests for this key or from your address. `Retry-After` says how many seconds until the next attempt is welcome |
| `500` | `internal_error` | Something went wrong on our side. The same request a moment later is the way forward |

## Examples

Each example deletes the key `STRGEXAMPLE7KQ2M4N9P`, authenticating with the key in
`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.

**curl**

```bash
curl -sS -X DELETE \
  -H "Authorization: Bearer $AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" \
  -w "%{http_code}\n" \
  https://api.strg.com/v1/access-keys/STRGEXAMPLE7KQ2M4N9P
```

This prints `204` once the key is deleted. For any other status, the error body is printed first,
directly followed by the status.

**Python (requests)**

```python title="delete_access_key.py"
import os

import requests

key_id = os.environ["AWS_ACCESS_KEY_ID"]
secret = os.environ["AWS_SECRET_ACCESS_KEY"]
target = "STRGEXAMPLE7KQ2M4N9P"

response = requests.delete(
    f"https://api.strg.com/v1/access-keys/{target}",
    headers={"Authorization": f"Bearer {key_id}:{secret}"},
)
if response.status_code == 204:
    print(f"Deleted {target}")
elif response.status_code == 404:
    print(f"{target} does not exist or is already deleted")
else:
    problem = response.json()
    raise SystemExit(f"{response.status_code} {problem['code']}: {problem['detail']}")
```

**JavaScript (fetch)**

```javascript title="delete-access-key.mjs"
const keyId = process.env.AWS_ACCESS_KEY_ID;
const secret = process.env.AWS_SECRET_ACCESS_KEY;
const target = "STRGEXAMPLE7KQ2M4N9P";

const response = await fetch(`https://api.strg.com/v1/access-keys/${target}`, {
  method: "DELETE",
  headers: { Authorization: `Bearer ${keyId}:${secret}` },
});
if (response.status === 204) {
  console.log(`Deleted ${target}`);
} else if (response.status === 404) {
  console.log(`${target} does not exist or is already deleted`);
} else {
  const problem = await response.json();
  throw new Error(`${response.status} ${problem.code}: ${problem.detail}`);
}
```

## Related

- [REST API overview](https://docs.strg.com/rest-api/overview) - authentication, errors and rate limits
- [List access keys](https://docs.strg.com/rest-api/list-access-keys) - where the id of a key to delete comes from
- [Get an access key](https://docs.strg.com/rest-api/get-access-key)
- [Create an access key](https://docs.strg.com/rest-api/create-access-key)
- [Access keys](https://docs.strg.com/access-keys) - what a key is, its permissions and scope