Rotate API Key

Beta
POST/v1/auth/api-keys/{id}/actions/rotate

Idempotent with Idempotency-Key header. Learn more

Rotates an API key by revoking the existing key and issuing a replacement with the same name, role, and expiration (unless overridden).

The replacement is a new key with its own ID; the rotated key keeps its ID and stays in the list, moving to a revoked status once its revocation takes effect. Use revoke_at to keep the old key working while you roll the new secret out.

The secret key is returned once and cannot be retrieved later, so you should store it securely. We provide some recommendations on how you can manage your API keys.

Role type requiredValues:admin
Only API keys or agents whose role has this type can call this endpoint.
idstring

ID of the API key to rotate.

The key must not already be revoked.

include[]optional arrayenumValues:rolerole.permissions

Sub-objects to expand in the response. When omitted, sub-objects are returned as null.

expires_atoptional string (date-time)

When the replacement key should expire.

If omitted, the replacement inherits the expiration of the key being rotated.

revoke_atoptional string (date-time)

When the old key should stop authenticating requests.

If omitted, the old key is revoked immediately. Set a future timestamp — up to 30 days out — to keep the old key working during a migration window; a timestamp in the past revokes it immediately.

objectstringenumValues:created_api_key

Resource type identifier.

api_key_secretstring

The secret used to authenticate requests, sent as a bearer token in the Authorization header.

This is the only response that ever contains the secret; if it is lost, rotate the key to issue a new one. Learn more about managing your API keys.

api_key_infoapi_key

The key's non-secret details, such as its ID, name, role, and expiration.

idstring

API key ID.

objectstringenumValues:api_key

Resource type identifier.

namestring

Human-readable name for the API key.

redacted_valuestring

Redacted key value safe for display.

The key's prefix followed by its last four characters, e.g. mrp_sk_prod_****hjt4.

roleroleExpandablenullable

Role assigned to the key, which determines the permissions of requests made with it.

idstring

Role ID.

objectstringenumValues:role

Resource type identifier.

namestring

Display name of the role.

Unique within the account.

typestringenumValues:adminuserscanner

The kind of role.

The type gates behavior that individual permissions do not cover, and some actions are reserved for a single role type.

  • admin: full administrative access. Sensitive areas such as API keys, billing, and third-party integrations are restricted to admins no matter what permissions another role holds.
  • user: a custom role tailored to a specific need, with its permissions defined explicitly. Roles created through the API always have this type.
  • scanner: the role used by shop-floor scanning stations, assigned automatically when a scanning-station user is created.
  • sales_rep: a role for sales representatives. Order analytics are scoped to the rep's own orders.
  • agent: a role assigned to an automated agent rather than a person.
ownerownernullable

Provenance of this role.

System-owned roles are platform-provided defaults shared across all accounts and cannot be updated or deleted; account-owned roles are custom to your account.

Always returned as null in this endpoint.
permissionsarray of stringExpandablenullable

Permissions granted by this role, in {permission}:{action} format, such as customers:read.

created_atstring (date-time)

Creation timestamp.

updated_atstring (date-time)

Last updated timestamp.

last_used_atstring (date-time)nullable

When the key was last used to authenticate a request.

Recorded at most once every 24 hours, so it can lag the key's most recent use by up to a day.

expires_atstring (date-time)nullable

When the key expires and stops authenticating requests.

A key with no expiration keeps working until it is revoked or rotated.

revoked_atstring (date-time)nullable

When the key's revocation takes effect.

A future timestamp means revocation was scheduled (for example, by a rotation) and the key continues to authenticate requests until that time.

created_atstring (date-time)

Creation timestamp.

updated_atstring (date-time)

Last updated timestamp.

Responses

201

Successful response for Rotate API Key