Rotate an API key
Issues a new secret for the same key id, name and scopes, and returns it once. Requires keys_write.
The old secret stops working immediately; there is no overlap window. A revoked key cannot be rotated. See Key rotation.
Authorizations
An API key (otsk_ + 64 hex) or a console session token.
Path Parameters
The key's id: key_ followed by 32 hex characters. Never the secret.
Response
The key, with its new secret.
A key with its secret. Only create and rotate return this.
Who a key acts as: a user, or a service account owned by the organization.
- Option 1
- Option 2
A permission a key or session holds.
runs_read, runs_write, keys_read, keys_write, members_read, members_write, billing_read, billing_write, usage_read A revoked key is kept, never deleted.
active, revoked The first 13 characters of the secret (otsk_ plus 8), for display.
The plaintext secret. Shown once. The service stores only its SHA-256 and cannot return this value again; a lost secret is rotated, not recovered.