ak secrets revoke

Use ak secrets revoke for the operation described below. The command help records its arguments, effects, and options.

Command contract

Remove an agent's grants on a secret, or all of them

Synopsis

Delete the grants an agent binary holds. Without --all this removes every decision — allow and block alike — on one exact scope, which is also how a block is cleared. --all is the panic button: it removes every grant that fingerprint holds, across all secrets, projects, and purposes.

This revokes grants, not secrets. The stored values are untouched and any copy the agent already read is still out there, so treat a panic revoke as the first step and ak secrets rotate <ref> as the second.

Effects: Removes matching rows from the grants file under AGENTKIT_HOME. The stored secret values are untouched, and so is any copy an agent already read.

Exit status: 0 success, 1 command failure, 2 invalid flags or arguments

ak secrets revoke [<ref>] [flags]

Examples

  ak secrets revoke ${REF} --agent sha256:${HASH}          # one scope
  ak secrets revoke --agent sha256:${HASH} --all           # panic button

Options

      --agent string     Agent binary fingerprint, sha256:<64 hex> (required)
      --all              Revoke every grant this agent holds, across all secrets
  -h, --help             help for revoke
      --json             Emit machine-readable JSON (implies --no-interactive)
      --no-interactive   Disable interactive prompts (CI-safe)
      --project string   Project slot; defaults to the AK project containing the current directory
      --purpose string   Purpose label of the grant to remove; matched literally
  -q, --quiet            Suppress non-error output on stderr
  -V, --verbose          Extra diagnostic output on stderr (loses to --quiet)
  -y, --yes              Assume yes for all prompts

SEE ALSO

• ak secrets - Manage named secret values (API keys, tokens)