Revoke an authentication credential

Revoke an authentication credential on an Embedded Wallet internal account.

Revocation is a two-step flow because it must be authorized by a session on a different credential on the same internal account:

1. Call DELETE /auth/credentials/{id} with no headers. The response is 202 with a payloadToSign, requestId, and expiresAt.

2. Use the session API keypair of an existing verified credential on the same internal account — other than the one being revoked — to build an API-key stamp over payloadToSign, then retry the same DELETE request with that full stamp as the Grid-Wallet-Signature header and the requestId echoed back as the Request-Id header. The signed retry returns 204.

The account must retain at least one authentication credential; an account with only a single credential cannot use this endpoint to revoke it.

An administrator’s credential (one with adminReference) is revoked with DELETE /auth/admin-credentials/{adminReference} instead, and is refused here with INVALID_INPUT.

DELETE /auth/credentials/{id}

Revoke an authentication credential

cURL

curl --request DELETE \
  --url https://api.lightspark.com/grid/2025-10-13/auth/credentials/{id} \
  --header 'Authorization: Basic <encoded-value>'

200

{
  "status": "PROCESSING",
  "message": "This login is still being processed. Retry the same request in a moment."
}

Authorizations

Authorization · string · header · required

API token authentication using format <api token id>:<api client secret>

Headers

Grid-Wallet-Signature · string

Full API-key stamp built over the prior payloadToSign with the session API keypair of an existing verified authentication credential on the same internal account (other than the one being revoked). Required on the signed retry; ignored on the initial call.

Request-Id · string

The requestId returned in a prior 202 response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with Grid-Wallet-Signature.

Path Parameters

id · string · required

The id of the authentication credential to revoke (the id field of the AuthMethod returned from POST /auth/credentials).

Response

200

application/json

The revocation's underlying wallet-provider activity is still in flight — a WalletOperationProcessing body with status: "PROCESSING". The client re-sends the same signed DELETE until it settles; the backend also reconciles the revocation to terminal on its own.

200 response returned by an Embedded Wallet operation that the wallet provider has accepted but not yet settled — a consensus- or approval-gated activity that is still in flight. It is not an error and needs no client action beyond patience: the backend reconciles the operation to its terminal state on its own. The client MAY re-send the byte-identical request to converge sooner; the request is idempotent and returns the settled success response once the operation completes.

status · enum<string> · required

Always PROCESSING. Marks a still-in-flight operation whose terminal result is not yet available.

Available options: PROCESSING

Example:

"PROCESSING"

message · string

Human-readable explanation that the operation is still being processed and the same request may be retried.

Example:

"This login is still being processed. Retry the same request in a moment."