If a key falls into the wrong hands or an employee leaves the company, revoke access immediately. In Alaio Vibecode, you can deactivate a specific API key, close an employee's access to an application or collaboration, or revoke a link.

Deactivate an API key

Use this option when a key is compromised, shared with the wrong person, or no longer needed. After you deactivate it, all requests that use this key are rejected. You can reactivate the key later if needed.

1. Go to Access > API Keys. Find the key by name, username, or prefix.
2. Click Three dots (...) next to the key and select Deactivate.

If you need the key again, click Three dots (...) next to it and select Activate.

If you no longer need the key, delete it: click Three dots (...) next to it and select Delete. If active servers, agents, or bots are linked to the key, link them to another key first. Otherwise, you cannot delete the key.

Remove an employee's access

Use this option when an employee leaves the company or changes roles. You can control who can open an app, edit its code, and access its server separately.

1. Go to Apps > Applications and select the app.
2. Click Access on the right, below the app name.
3. In the window that opens, select a tab and click Remove (X) next to the employee's name:

• Share application — Prevent the employee from opening the app.
• Collaboration — Remove the employee from the development team and revoke their access to the code and server. You can also choose to prevent them from opening the app.

Changes are saved automatically.

If the employee has left the company, deactivate their user profile in Bitrix24 as well. This prevents them from accessing the entire Bitrix24 account, not just the server.
Dismiss users

Revoke an access link

Revoke an access link if it was shared with unauthorized users or is no longer needed. After you revoke it, the link stops working and can no longer be used to access the server.

Anyone who already got access through the link will keep it. Close their access separately in the application's access settings.

1. Go to Hosting > Black Hole Servers.
2. For the server you need, click any tab, such as Access.
3. In the window that opens, select the Links tab.
4. Find the link in the list and click the delete icon next to it.

Delete an app and its related resources

Use this option when you no longer need the app at all. You cannot undo this action. To use the app again, you'll need to create it from scratch.

When deleting an app, you can also delete its related resources, including the server or container, API key, and authentication key. Any resources you don't select will remain unchanged. If you delete the server or container, its data is permanently deleted. Save any files and backups you need beforehand.

1–2. Go to Apps > Applications and select the app.
3–4. In the application form, click Three dots (...) and select Delete.
5. Choose which related resources to delete with the application: the server or container, the API key, and the authorization key.
6. Confirm the action by clicking Delete.
Update or remove an AI solution in Alaio Vibecode

Check server access

After any of these actions, make sure access is closed. The server log shows who accessed the server and when, as well as the number of requests and errors.

1. Go to Hosting > Black Hole Servers.
2. For the server you need, click Journal and review the most recent server access.

What to do if an API key is stolen

If you suspect someone has stolen an API key, take these steps immediately:

1. Go to Access > API Keys and deactivate the key.
2. Open the Journal tab on the server and review activity from the last few hours.
3. If you find suspicious activity and the app runs on a separate server, temporarily deactivate the server.
4. Contact Bitrix24 Support. They can help you check whether someone used the stolen key.