Skip to main content
You need a root key with the permissions listed on this page. Create one in the dashboard under Settings > Root Keys, and pass it as Authorization: Bearer <root key>. See Permission reference for every permission.
Remove direct permissions from a key. This doesn’t touch permissions the key gets from a role. Remove the role for those. Changes can take up to about 10 seconds to apply. Calls POST /v2/keys.removePermissions. See Managing key permissions.

​
Usage

​
Flags

​
string
required
Id of the key.
​
string[]
required
Comma-separated permission slugs to remove. A slug that doesn’t exist fails the call instead of being ignored.

​
Shared flags

Every unkey api command takes these. See CLI output and shared flags.
​
string
Root key used for the request. Falls back to UNKEY_ROOT_KEY, then to the key stored by unkey auth login.
​
string
default:"https://api.unkey.com"
Base URL of the API. Falls back to UNKEY_API_BASE_URL. You don’t normally need to set it.
​
string
default:"~/.unkey/config.toml"
Path of the config file written by unkey auth login. Falls back to UNKEY_CONFIG.
​
string
Output format. Falls back to UNKEY_OUTPUT. json prints the full response. Any other value prints the request ID and data.
​
string
Send this JSON as the whole request body instead of using the command’s flags. You can’t combine it with them.

​
Required permissions

api.*.update_key or api.<apiId>.update_key together with rbac.*.remove_permission_from_key. See Root key permissions.

​
Examples

Remove a permission
Or send the whole request as JSON:
Raw body
Last modified on September 29, 2026