Sign this device out

DELETE /v1/cowork/key

Revokes the key used to make this call — the application on this device immediately loses access to the Bitrix24 account. The request includes no identifier, so you cannot use this endpoint to sign out any other device.

Only a Cowork/Code desktop key with the vibe:cowork scope can call this endpoint. Agent seat keys and project deploy keys have the same scope but receive 403 COWORK_DESKTOP_KEY_REQUIRED.

Scope: vibe:cowork; the key must also be a Cowork/Code desktop key. The request body is ignored.

Examples

This endpoint supports only one authorization method: a Cowork/Code desktop key. An OAuth app cannot use it because its key belongs to a different class and receives 403 COWORK_DESKTOP_KEY_REQUIRED.

curl — Cowork/Code key

curl -X DELETE https://vibecode.bitrix24.com/v1/cowork/key \
  -H "X-Api-Key: YOUR_COWORK_KEY"

JavaScript — Cowork/Code key

const res = await fetch('https://vibecode.bitrix24.com/v1/cowork/key', {
  method: 'DELETE',
  headers: { 'X-Api-Key': 'YOUR_COWORK_KEY' },
})

if (res.ok) {
  // The key has been revoked — delete the local copy of the secret and show the sign-in screen.
} else if (res.status === 404) {
  const body = await res.json()
  if (body.error?.code === 'ROUTE_NOT_FOUND') {
    // The platform version predates the endpoint: keep the local session and show no error.
  }
}

Response fields

Response example

{
  "success": true
}

Error response example

403 — the request used a key of a different class:

{
  "success": false,
  "error": {
    "code": "COWORK_DESKTOP_KEY_REQUIRED",
    "message": "Only a Cowork/Code desktop key may revoke itself on this endpoint."
  }
}

Errors

See Errors for the full list of common API errors.

Known specifics

Emergency sign-out remains available when other calls are blocked. A balance freeze on the Bitrix24 account and the daily call quota do not apply to this endpoint, nor does the platform-level Cowork/Code switch block it. Read-only keys are also accepted: revoking your own secret does not count as a chargeable operation.

A repeat call is safe, but the response changes. While the authentication record remains cached, a repeat call returns 200 and does nothing. After the cache expires, the same key receives 401 KEY_INACTIVE. Both responses mean that the key is inactive.

Revocation takes effect immediately, but if the notification bus is unavailable, other replicas may keep accepting the secret for up to 30 seconds. Do not retry automatically. If you retry, do so at most once and wait at least 30 seconds; otherwise, the sign-out action may hit the rate limit.

Revocation does not disable the project deploy key. The key issued through POST /v1/cowork/deploy-key continues to work, as do the server access tokens it issued. Revoke the deploy key and its tokens in your Vibecode account. In-app copy must describe this action as signing out a single device, not revoking all access.

The owner is not notified about the revocation. The operation remains in the Bitrix24 account audit log, which the Bitrix24 account administrator can view in the Vibecode dashboard.

Other devices continue to work. Each device has its own key, and revocation deactivates only the key presented in the request.

See also

• Cowork/Code
• Project key for deploy
• Cowork/Code endpoints
• Errors