If your package no longer includes the API — for example after moving from Pro — Security › Developer still lists what is open, under Keys and webhooks from your earlier package are still open.
- A key there still signs in, but only to read your channels and conversations. Sending or changing anything is refused until the API is in your package again.
- Webhooks still receive your events.
- Owners and admins can Revoke a key, and Switch off or delete a webhook. New keys and webhooks need the API in your package.