medusajs/medusa · error · MedusaError

You must provide a revoked_by field when revoking a key.

Error message

You must provide a revoked_by field when revoking a key.

What it means

Thrown by the API Key module's revoke validation when one or more keys in the revoke batch lack a revoked_by value. The module records who revoked each key for audit purposes, so the field is mandatory on every revoke call.

Source

Thrown at packages/modules/api-key/src/services/api-key-module-service.ts:546

  }

  protected async validateRevokeApiKeys_(
    data: RevokeApiKeyInput[],
    sharedContext: Context = {}
  ): Promise<void> {
    if (!data.length) {
      return
    }

    if (data.some((k) => !k.id)) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        `You must provide an api key id field when revoking a key.`
      )
    }

    if (data.some((k) => !k.revoked_by)) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        `You must provide a revoked_by field when revoking a key.`
      )
    }

    const revokedApiKeys = await this.apiKeyService_.list(
      {
        id: data.map((k) => k.id),
        type: ApiKeyType.SECRET,
        revoked_at: { $lt: new Date() },
      },
      {},
      sharedContext
    )

    if (revokedApiKeys.length) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Add revoked_by (typically the logged-in admin user id) to every item: revoke([{ id, revoked_by: authUserId }])
2. If calling from a route, pass req.auth_context.user_id as revoked_by
3. Check the zod/schema validation upstream so the field is required before reaching the module

Example fix

// before
await apiKeyModuleService.revoke([{ id: apiKeyId }])
// after
await apiKeyModuleService.revoke([
  { id: apiKeyId, revoked_by: loggedInUserId },
])

const input = [{ id, revoked_by }]
if (input.some((k) => !k.revoked_by)) {
  throw new Error('revoked_by is required for every key')
}
await apiKeyModuleService.revoke(input)

When it happens

Trigger: Calling revokeApiKeys / revoke workflow with input objects that omit revoked_by, e.g. revoke([{ id: 'apk_...' }]) — any entry in the array missing revoked_by triggers it.

Common situations: Scripts or admin customizations that copy the create/update payload shape for revoke; passing only ids; forgetting that revoked_by is per-item, not a top-level argument.

Understand the failure class

Background: "Missing required field" and "field is required" errors: why libraries reject payloads that omit mandatory fields — this error's family across 20 libraries.

Related errors

• You must provide an api key id field when revoking a key.
• There are ${revokedApiKeys.length} secret keys that are alre
• --paths must be a directory - ${additionalPath}
• --base must be a file - ${baseFile}
• insufficient_inventory

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/6b905d0e18213ecf. Report an issue: GitHub.