Rotate an API key
Issues a new secret for the same key id, name and scopes, and returns it once. Requires keys_write.
The old secret stops working immediately; there is no overlap window. A revoked key cannot be rotated. See Key rotation.
curl --request POST \
--url https://api.opentype.dev/v1/keys/{key_id}/rotate \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.opentype.dev/v1/keys/{key_id}/rotate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.opentype.dev/v1/keys/{key_id}/rotate"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text){
"id": "<string>",
"name": "<string>",
"principal": {
"id": "<string>",
"type": "user"
},
"scopes": [
"runs_read"
],
"state": "active",
"secret_prefix": "<string>",
"created_by": "<string>",
"created_at": "<string>",
"secret": "<string>",
"last_used_at": "<string>",
"revoked_at": "<string>"
}Authorizations
An API key (otsk_ + 64 hex) or a console session token.
Path Parameters
The key's id: key_ followed by 32 hex characters. Never the secret.
Response
The key, with its new secret.
A key with its secret. Only create and rotate return this.
Who a key acts as: a user, or a service account owned by the organization.
- Option 1
- Option 2
Show child attributes
Show child attributes
A permission a key or session holds.
runs_read, runs_write, keys_read, keys_write, members_read, members_write, billing_read, billing_write, usage_read A revoked key is kept, never deleted.
active, revoked The first 13 characters of the secret (otsk_ plus 8), for display.
The plaintext secret. Shown once. The service stores only its SHA-256 and cannot return this value again; a lost secret is rotated, not recovered.
curl --request POST \
--url https://api.opentype.dev/v1/keys/{key_id}/rotate \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.opentype.dev/v1/keys/{key_id}/rotate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.opentype.dev/v1/keys/{key_id}/rotate"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text){
"id": "<string>",
"name": "<string>",
"principal": {
"id": "<string>",
"type": "user"
},
"scopes": [
"runs_read"
],
"state": "active",
"secret_prefix": "<string>",
"created_by": "<string>",
"created_at": "<string>",
"secret": "<string>",
"last_used_at": "<string>",
"revoked_at": "<string>"
}