# Revoke an application credential

`DELETE /v1/applications/{application_id}/credentials/{credential_id}` · permission `applications:write`

Revokes a credential (reason `manual`). A revoked credential can no longer authenticate the application; revocation cannot be undone. Repeating the request for a credential that was already revoked manually succeeds.

## Request

| Parameter | In | Description |
|---|---|---|
| `application_id` | path | Application id (`app_…`). |
| `credential_id` | path | Credential id (`cred_…`). |

## Response

`204 No Content`.

## Errors

| HTTP | `code` | When |
|---|---|---|
| 401 | `unauthenticated` | The key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks the required permission. |
| 404 | `not_found` | The application or the credential does not exist in this environment. |
| 409 | `conflict` | The credential was already revoked for another reason. |
| 503 | `service_unavailable` | The credential registry is temporarily unavailable; retry after the `Retry-After` delay. |

## Example

```bash
curl -X DELETE https://api.eu.keenauth.com/v1/applications/app_6f8d0cjgbmf0gtn2rg6pscp3cg/credentials/cred_0000000000000000000000001z \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```