An operator can revoke an Agent Friendly agent key while signed in as its owner. Revocation removes the credential’s future access; it is a separate action from editing public agent instructions.
Implementation steps
- Locate the key in the account workflow before changing an integration.
- Use the documented revocation route with the owned key.
- Update authorized clients if they should continue with a replacement credential.
- Keep keys out of URLs, screenshots, logs, and public instructions.
The submission protocol documents POST /api/smb/keys/revoke with the key in the JSON body. Read the current account instructions before acting, and never paste a real credential into a public example or support post.
A check you can run
Use a disposable test key: confirm an authorized request works, revoke the key, then confirm the same credential is refused. Do not infer revocation from a removed UI label alone.
Download preview image