List, revoke, and prune API keys from the terminal - the CLI-side equivalent of the API Keys dashboard

`armoriq keys`

Manage the API keys on your account without opening the dashboard. Three subcommands:

armoriq keys list              # show every key on the account
armoriq keys revoke <key_id>   # revoke one key
armoriq keys prune [--yes]     # revoke expired and unused keys

All three are available in both SDKs - Python (pip install armoriq-sdk) and TypeScript (npm install @armoriq/sdk). They require saved credentials, so run armoriq login first.

armoriq keys revoke and armoriq keys prune --yes destroy credentials. A revoked key stops authenticating immediately, and any agent still using it starts failing with 401. Read the prune selection rule before running it with --yes.

`armoriq keys list`

Prints every key on the account - name, id, status, and when it was last used. No flags.

armoriq keys list

Output:

  NAME            ID                                    STATUS    LAST USED
  --------------------------------------------------------------------------------
  cli-2026-04-22  3f8c1d02-9a44-4e6b-8b71-2c5a90e13f77  active    2026-08-04T09:12:41Z
  ci-deploy       a1b9e733-51cd-4a70-9f0e-6d2b84c71a05  active    2026-02-11T22:03:08Z
  macbook-old     7d40c6ae-2f18-4c93-8a55-b0e1f7392c4d  active    -
  laptop-2025     c52f88b1-6e3a-41d7-b9c2-4f8a0d15e6b3  revoked   2026-01-30T14:55:02Z

Notes on the columns:

ID is the key's identifier, not its secret. The secret is only ever shown once, at creation. revoke takes this id.
LAST USED prints - when the key has never authenticated a request.
Keys already revoked stay in the listing with status revoked.

If the account has no keys at all, the command prints No API keys found for this account. and exits 0.

Past 8 keys, the listing ends with a nudge:

! You have 11 API keys. Consider `armoriq keys prune` to revoke unused keys.

That is advisory only - the exit code is still 0.

`armoriq keys revoke`

Revokes a single key by id.

Arguments:

<key_id> (required, positional) - the key's id from armoriq keys list. Not the secret value.

armoriq keys revoke a1b9e733-51cd-4a70-9f0e-6d2b84c71a05

Output:

✓ Revoked key a1b9e733-51cd-4a70-9f0e-6d2b84c71a05.

This is the terminal equivalent of deleting a key in the API Keys dashboard, and it is what closes the gap left by armoriq logout, which only removes the local credentials file and leaves the server-side key valid.

Revoking is not reversible. To restore access, mint a new key with armoriq login or from the dashboard.

`armoriq keys prune`

Bulk-revokes keys that look abandoned.

Flags:

--yes - actually revoke. Without it, prune is a dry run.

armoriq keys prune          # dry run - lists candidates, changes nothing
armoriq keys prune --yes    # revoke the listed candidates

Dry-run output (no --yes):

Found 2 prune candidate(s):
  a1b9e733-51cd-4a70-9f0e-6d2b84c71a05 ci-deploy (last used 2026-02-11T22:03:08Z)
  7d40c6ae-2f18-4c93-8a55-b0e1f7392c4d macbook-old (last used never)

Re-run with --yes to actually revoke these.

With --yes:

Found 2 prune candidate(s):
  a1b9e733-51cd-4a70-9f0e-6d2b84c71a05 ci-deploy (last used 2026-02-11T22:03:08Z)
  7d40c6ae-2f18-4c93-8a55-b0e1f7392c4d macbook-old (last used never)
✓ Revoked a1b9e733-51cd-4a70-9f0e-6d2b84c71a05
✓ Revoked 7d40c6ae-2f18-4c93-8a55-b0e1f7392c4d

When nothing qualifies:

Nothing to prune: all keys are either active, recent, or already revoked.

Individual revocations are attempted independently - if one fails, prune prints ✘ Failed to revoke <id>: <reason> for that key and continues with the rest. The command still exits 0.

prune has no interactive confirmation prompt. The dry run is the confirmation step: run it bare, read the list, then re-run with --yes. That also makes it safe to schedule in CI, where a prompt would hang.

Which keys prune selects

A key is a prune candidate when any of these is true:

Condition	Threshold
`expiresAt` is in the past	expired at all
`lastUsedAt` is older than the cutoff	90 days
Never used, and `createdAt` is older than the cutoff	30 days

A key is excluded when:

its status is already revoked, or
it is the key the CLI is currently authenticating with (see the caveat below).

The two windows are different on purpose: a key that has proven itself in use gets 90 days of grace, while one that was minted and never touched gets 30.

Verify before you run --yes on a shared org. The "never prune the key you are authenticating with" exclusion is unreliable in the current SDKs (0.6.7) - it compares a key id against the secret in ~/.armoriq/credentials.json, which never matches, so your own active key can be selected if it is expired or has been idle past the window. Read the dry-run list and confirm your current key is not in it. Tracked as a separate SDK bug; armoriq whoami shows which key you are on.

Typical uses

Quarterly credential hygiene

armoriq keys list           # see the sprawl
armoriq keys prune          # dry run - what would go
armoriq keys prune --yes    # revoke it

Decommission a machine

armoriq keys list                                        # find its key by name
armoriq keys revoke 7d40c6ae-2f18-4c93-8a55-b0e1f7392c4d

After logging out on a laptop you no longer control

armoriq logout on that machine only deletes the local file. From any machine still logged in:

armoriq keys revoke <that-machine's-key-id>

In CI

- run: armoriq keys prune --yes
  env:
    ARMORIQ_API_KEY: ${{ secrets.ARMORIQ_API_KEY }}

Run the dry run locally first and confirm the CI key itself is not a candidate - a long-lived CI key that goes 90 days between builds qualifies for pruning.

armoriq login - mints a new key each time it runs
armoriq orgs - switch-org also mints a fresh, org-scoped key
API Keys dashboard - the same operations in the UI, plus key creation
All CLI commands - including the per-SDK support matrix

armoriq keys

On this page