> Source: [/docs/accounts/access-keys/revocation](https://tempo.xyz/developers/docs/accounts/access-keys/revocation.md) > Section: [Accounts](https://tempo.xyz/developers/docs/accounts.md). Create accounts, set up signing methods, policies, access keys, key rotation, and fees, and follow guides for users, automations, agents, and teams. > [Documentation index](https://tempo.xyz/developers/llms.txt) · [Docs skill](https://tempo.xyz/developers/SKILL.md) > Tempo MCP: Use `search`, `find_pages`, `read_page`, and `code` at `https://mcp.tempo.xyz` for Tempo and related documentation. > If an indexed page is missing or reflects an older site, read this site’s [documentation index](https://tempo.xyz/developers/llms.txt) and Markdown pages directly. # Revocation Shuts off an access key for good. ## Overview Revocation ends an [access key](https://tempo.xyz/developers/docs/accounts/access-keys) on demand, without waiting for its [expiry](https://tempo.xyz/developers/docs/accounts/access-keys/expiry). Once the revocation lands, Tempo rejects every transaction the key signs. Revoke a key as soon as its device is lost, its secret leaks, or its holder no longer needs it. ## Remaining Effects Revocation doesn't undo what the key did while it was active: * **Transactions Stay Final:** A payment racing the revocation goes through only if it lands first. Once the revocation lands, Tempo rejects the rest. * **Token Approvals Stay:** A spender the key approved still pulls tokens up to the allowance. Set each allowance to zero from the account. * **Authorized Keys Stay:** If it was an admin key, the keys it authorized stay authorized. Revoke each one. ## Revoke a Key Enough of the account's signers to meet its threshold, or an [admin key](https://tempo.xyz/developers/docs/accounts/access-keys/admin-access-keys), approve the revocation. In Viem, call [`accessKey.revoke`](https://viem.sh/tempo/actions/accessKey.revoke) with the account and the key's address. When you authorize a key, save its address next to the device or service that holds it. That record tells you which address to revoke. Show a key as removed only after the revocation confirms. ## Signer Changes :::warning **Multiple signers arrive with the [T14 network upgrade](https://tempo.xyz/developers/docs/protocol/upgrades/t14).** Until T14 activates, an account with several signers and a threshold runs only on the [Tempo Accounts devnet](https://tempo.xyz/developers/docs/accounts/create#connect-to-the-devnet), not on mainnet or testnet, and may still change. ::: Changing a configurable account's signers doesn't touch its access keys. Revoke them yourself after a recovery and before a hand-off. After you [replace a lost or compromised signer](https://tempo.xyz/developers/docs/accounts/account-configuration/configuration-updates#remove-a-lost-or-compromised-signer), revoke every key that signer's holder could use. That includes any key an attacker authorized. You won't have those addresses saved, so list every key the account has authorized from its `KeyAuthorized` events. Read the events in pages, because the devnet RPC searches at most 100,000 blocks per request. ```ts [find-keys.ts] import { Abis, Addresses } from 'viem/tempo' import { account } from './access-keys' import { client } from './client' const latestBlock = await client.getBlockNumber() const pageSize = 100_000n const events = [] // Start from 0, or from the block of the account's first transaction if you saved it for (let fromBlock = 0n; fromBlock <= latestBlock; fromBlock += pageSize) { const toBlock = fromBlock + pageSize - 1n const page = await client.getContractEvents({ // [!code hl] abi: Abis.accountKeychain, address: Addresses.accountKeychain, args: { account: account.address }, eventName: 'KeyAuthorized', // [!code hl] fromBlock, toBlock: toBlock < latestBlock ? toBlock : latestBlock, strict: true, }) events.push(...page) } const keys = await Promise.all( events.map(({ args }) => client.accessKey.getMetadata({ account, accessKey: args.publicKey })), ) // compare with the keys you saved const unrevoked = keys.filter((key) => !key.isRevoked) // [!code hl] ``` Before you [hand an account to a customer](https://tempo.xyz/developers/docs/accounts/apps/self-custodial-wallets), revoke your app's access keys, then swap out your app's signers. Once your signers are gone, your app can't approve anything, including a revocation. ## Limits * A limited access key can't revoke any key, including itself. * A revoked key's address can never be authorized again for this account. To restore access, authorize a new key. * Revoking a key the account hasn't authorized reverts with [`KeyNotFound`](https://tempo.xyz/developers/docs/protocol/transactions/AccountKeychain#error-keynotfound). That includes a key whose authorization hasn't landed yet. If you signed the authorization with a [witness](https://viem.sh/tempo/guides/access-keys/witnesses), a 32-byte value, cancel it with `client.accessKey.burnWitnessSync({ account, witness })`. Tempo then rejects any authorization signed with that witness. * An expired key needs no revocation. Tempo already rejects its transactions. Specification: [Account Keychain key revocation](https://tempo.xyz/developers/docs/protocol/transactions/AccountKeychain#key-revocation). ## Related [Access Keys](https://tempo.xyz/developers/docs/accounts/access-keys): Covers how access keys sign for an account within their bounds. [Expiry](https://tempo.xyz/developers/docs/accounts/access-keys/expiry): Covers when a key stops working on its own. [Configuration Updates](https://tempo.xyz/developers/docs/accounts/account-configuration/configuration-updates): Use for replacing a lost or compromised signer. [Set Up a Self-Custodial Wallet With a Provider](https://tempo.xyz/developers/docs/accounts/apps/self-custodial-wallets): Use for handing an account to a customer.