Actually set the revoked flag

src/pretix/api/views/device.py

@@ -105,7 +105,7 @@ class RevokeKeyView(APIView):
 
     def post(self, request, format=None):
         device = request.auth
-        device.api_token = None
+        device.revoked = True
         device.save()
         device.log_action('pretix.device.revoked', auth=device)
 

src/pretix/control/views/organizer.py

@@ -756,7 +756,7 @@ class DeviceRevokeView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixi
 
     def post(self, request, *args, **kwargs):
         self.object = self.get_object()
-        self.object.api_token = None
+        self.object.revoked = True
         self.object.save()
         self.object.log_action('pretix.device.revoked', user=self.request.user)
         messages.success(request, _('Access for this device has been revoked.'))

src/tests/api/test_deviceauth.py

@@ -145,4 +145,4 @@ def test_revoke_valid(device_client, device: Device):
     resp = device_client.post('/api/v1/device/revoke')
     assert resp.status_code == 200
     device.refresh_from_db()
-    assert not device.api_token
+    assert device.revoked