Delete an API Key-Resource Access Management(RAM)-阿里云帮助中心

Before you can delete an API Key, you must disable it. After deletion, the credential is permanently destroyed and cannot be recovered.

After an API Key is deleted, all OpenAPI calls that use the credential will fail. We recommend that you disable the API Key first and observe for a period of time to confirm that no services depend on it before you delete it.

Prerequisites

The API Key is in the Inactive state: An API Key in the Active state cannot be deleted directly. The Delete button in the console is grayed out. You must disable it first.
Required permissions: The permission requirements vary depending on the scenario:
- Deleting your own API Key: The following two conditions must be met:
  1. The Alibaba Cloud account has allowed RAM users to manage their own API Keys. To enable this feature:
    - Console: Log on to the RAM console, go to Security Settings, and enable Allow RAM users to manage their own API Keys.
    - API: Call SetSecurityPreference and set the AllowUserToManageServiceCredential parameter to true.
  2. No administrator has explicitly denied the RAM user permissions to manage API Keys through a Deny policy statement.
- Deleting another user's API Key: The operator has been granted a policy that includes the ram:DeleteServiceCredential action. To restrict this permission to a specific cloud service, you can configure the ram:ServiceCredentialServiceName condition key in the policy.

Warning

Deletion is irreversible. Before you proceed, make sure that all callers have switched to other credentials.

Delete an API Key in the RAM console

Log on to the RAM console and go to the Credential tab of the target RAM user.
If the target API Key is in the Active state, click Disable in the Actions column and complete the disabling process first.
Click Delete in the Actions column.
In the Delete dialog box, enter the AccessKey ID of the API Key to be deleted in the input field as prompted for secondary confirmation.

Important
The AccessKey ID must match exactly. The Move to Recycle Bin button is enabled only after you enter the correct AccessKey ID.
Click Move to Recycle Bin. The system displays the message "AccessKey {id} has been moved to the recycle bin.", and the credential disappears from the list.

Delete an API Key by calling OpenAPI

Call DeleteServiceCredential to delete an API Key. Before you call this operation, make sure the Status is Inactive. Otherwise, an error is returned.

Parameter	Type	Required	Description
ServiceCredentialId	String	Yes	The service credential ID.
UserPrincipalName	String	Yes	The logon name of the RAM user.

Impact of deletion

Request failure : All requests that use the deleted API Key to call the OpenAPI operations of the bound cloud service will fail. Complete credential rotation on the application side in advance.
Irrecoverable: After deletion, the API Key cannot be recovered. If you still need access to the service, create a new API Key.
RAM user deletion check: When you delete a RAM user, the system checks whether the user still has API Keys. If so, you must delete all of the user's API Keys before you can delete the user.