## Sign this device out

`DELETE /v1/cowork/key`

Revokes the key used to make this call — the application on this device immediately loses access to the Bitrix24 account. The request includes no identifier, so you cannot use this endpoint to sign out any other device.

Only a Cowork/Code desktop key with the `vibe:cowork` scope can call this endpoint. Agent seat keys and project deploy keys have the same scope but receive `403 COWORK_DESKTOP_KEY_REQUIRED`.

**Scope:** `vibe:cowork`; the key must also be a Cowork/Code desktop key. The request body is ignored.

## Examples

This endpoint supports only one authorization method: a Cowork/Code desktop key. An OAuth app cannot use it because its key belongs to a different class and receives `403 COWORK_DESKTOP_KEY_REQUIRED`.

### curl — Cowork/Code key

```bash
curl -X DELETE https://vibecode.bitrix24.com/v1/cowork/key \
  -H "X-Api-Key: YOUR_COWORK_KEY"
```

### JavaScript — Cowork/Code key

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/cowork/key', {
  method: 'DELETE',
  headers: { 'X-Api-Key': 'YOUR_COWORK_KEY' },
})

if (res.ok) {
  // The key has been revoked — delete the local copy of the secret and show the sign-in screen.
} else if (res.status === 404) {
  const body = await res.json()
  if (body.error?.code === 'ROUTE_NOT_FOUND') {
    // The platform version predates the endpoint: keep the local session and show no error.
  }
}
```

## Response fields

| Field | Type | Description |
|-------|------|-------------|
| `success` | boolean | Always `true` on success. The key was revoked by this request or had already been revoked |

## Response example

```json
{
  "success": true
}
```

## Error response example

`403` — the request used a key of a different class:

```json
{
  "success": false,
  "error": {
    "code": "COWORK_DESKTOP_KEY_REQUIRED",
    "message": "Only a Cowork/Code desktop key may revoke itself on this endpoint."
  }
}
```

## Errors

| HTTP | Code | Description |
|------|------|-------------|
| 401 | `MISSING_API_KEY` | The `X-Api-Key` header is missing |
| 401 | `INVALID_API_KEY` | The key was not found |
| 401 | `KEY_INACTIVE` | The key was already revoked, and the authentication cache has since expired |
| 403 | `INSUFFICIENT_SCOPE` | The key lacks the `vibe:cowork` scope |
| 403 | `COWORK_DESKTOP_KEY_REQUIRED` | The key does not belong to the Cowork/Code desktop class. This response applies to both agent seat keys and project deploy keys |
| 415 | `FST_ERR_CTP_INVALID_MEDIA_TYPE` | The request body uses a content type this route does not parse. Send the request with no body, or with an empty body and the `Content-Type: application/json` header |
| 429 | `RATE_LIMITED` | The rate limit for the portal, key owner, and key combination has been exceeded. The platform-wide limit is 5 requests per minute. The effective limit for your key is returned in the `x-ratelimit-limit` header. It is lower than the platform-wide limit because that limit is divided across replicas |

See [Errors](/docs/errors) for the full list of common API errors.

## Known specifics

**Emergency sign-out remains available when other calls are blocked.** A balance freeze on the Bitrix24 account and the daily call quota do not apply to this endpoint, nor does the platform-level Cowork/Code switch block it. Read-only keys are also accepted: revoking your own secret does not count as a chargeable operation.

**A repeat call is safe, but the response changes.** While the authentication record remains cached, a repeat call returns `200` and does nothing. After the cache expires, the same key receives `401 KEY_INACTIVE`. Both responses mean that the key is inactive.

**Revocation takes effect immediately, but if the notification bus is unavailable, other replicas may keep accepting the secret for up to 30 seconds.** Do not retry automatically. If you retry, do so at most once and wait at least 30 seconds; otherwise, the sign-out action may hit the rate limit.

**Revocation does not disable the project deploy key.** The key issued through [`POST /v1/cowork/deploy-key`](/docs/cowork/deploy-key) continues to work, as do the server access tokens it issued. Revoke the deploy key and its tokens in your Vibecode account. In-app copy must describe this action as signing out a single device, not revoking all access.

**The owner is not notified about the revocation.** The operation remains in the Bitrix24 account audit log, which the Bitrix24 account administrator can view in the Vibecode dashboard.

**Other devices continue to work.** Each device has its own key, and revocation deactivates only the key presented in the request.

## See also

- [Cowork/Code](/docs/cowork)
- [Project key for deploy](/docs/cowork/deploy-key)
- [Cowork/Code endpoints](/docs/cowork/endpoints)
- [Errors](/docs/errors)