Hey — I tried to open a support ticket through the Composio dashboard, but the ticket panel doesn't work (can't submit / create tickets there), so I'm reaching out here instead. We need help removing two orphaned SHARED connected accounts from our project after the May security incident. Both are API_KEY integrations (Amplitude and Ahrefs). We're already rotating the credentials directly with those providers per your guidance, but we still need the Composio records gone. Our project API key can see the accounts but can't delete them — DELETE returns 403 (creator-only for SHARED), revoke doesn't work for API_KEY, and there's no delete option in the dashboard. We also can't figure out which userId created them — they don't match our integration setup. Could you hard-delete them on your side, or point us to the right way to clean this up as a project admin? Happy to share more technical details in thread if needed. Thanks!

hey @ahanusek the dashboard is back online, you should be able to create and delete API keys now.

{
  "error": {
    "message": "No authentication provided",
    "code": 10401,
    "slug": "HTTP_Unauthorized",
    "status": 401,
    "request_id": "99accb02-9f9c-4b4c-aa1e-629a2fd921ef",
    "suggested_fix": "Please check you are using a valid API key."
  }
}

@Thomas https://cdn.discordapp.com/attachments/1508447013346214018/1508819299702411274/Zrzut_ekranu_2026-05-26_o_15.08.34.png?ex=6a16ecf9&is=6a159b79&hm=380aa5460cc60c92c58a35d27e846c5d5b523d6de3a3bcaf2bee2a3c57c6bd5c&

@Thomas , any progress in this case?

Hi there, Thanks for the detail, and rotating the credentials directly with Amplitude and Ahrefs is exactly the right move. The 403 here is expected and separate from the post-incident dashboard work: a SHARED connection can only be deleted (or revoked) by the org member who originally created it, and there's no project-admin override for that today. That's why your project key can read the accounts and patch credentials, but can't delete them, and why there's no delete option in the dashboard for them. For orphaned accounts where the creator is gone, that leaves no self-serve path. We can remove these on our side. Could you reply here with the two connected account IDs (the

ca_...

nano-IDs) for the Amplitude and Ahrefs accounts? Once I have those, we'll clean up the records for you. This response was generated automatically by Composio's AI support agent. If it doesn't fully resolve your issue, or you'd like to speak with a person, just reply here and a member of our team will take a look.

hi @ahanusek

Thanks for the detail, and rotating those credentials directly with Amplitude and Ahrefs was the right call. To confirm: that 403 is expected and it is not the post-incident dashboard work. A SHARED connection can only be deleted by the org member who originally created it, with no project-admin override today, which is why your project key can read and patch these but not delete them. For orphaned accounts where the creator is gone, that leaves no self-serve path, so we will remove them for you. Could you reply here with the two

ca_...

connected account IDs for the Amplitude and Ahrefs accounts? Once I have those, we will clean up the records on our side.