---
title: "Rotate DataHub token-service secrets"
method: POST
path: "/project/{project}/service/{service_name}/rotate-token-service-secrets"
tags: ["Service"]
---

# Rotate DataHub token-service secrets

`POST /project/{project}/service/{service_name}/rotate-token-service-secrets`

Generates fresh values for DATAHUB\_TOKEN\_SERVICE\_SIGNING\_KEY (the key GMS uses to sign API access tokens) and DATAHUB\_TOKEN\_SERVICE\_SALT (the salt behind the token revocation-check hash), updates every DataHub app child that carries them, and triggers a coordinated restart so the new values take effect everywhere simultaneously. USER-VISIBLE SIDE EFFECT: every previously issued API access token (personal access tokens, service tokens) is permanently invalidated. The tokens are stateless JWTs, so the old key and salt cannot be recovered and matching tokens cannot be reissued. Users and automations must create new API tokens through the UI or GraphQL API. Browser sessions (cookie-based) are unaffected.

## Path parameters

- `project` string, required
- `service_name` string, required

## Response `200`

Response

- ServiceDataHubRotateTokenServiceSecretsResponse — ServiceDataHubRotateTokenServiceSecretsResponse
  - `errors` object[] — List of errors occurred during request processing
    - `message` string, required — Printable error message
    - `more_info` string — URL to the documentation of the error
    - `status` integer, required — HTTP error status code
  - `message` string, required — Printable result of the request
  - `rotation` object, required — DatahubSecretRotationGroup
    - `group` string, required — Rotated secret group

## Other responses

- `404` — Resource not found
- `409` — Request conflict

---

[API](https://skmtc.net/aiven/apis/aiven-api-documentation.md) · [All operations](https://skmtc.net/aiven/apis/aiven-api-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aiven/aiven-api-documentation/versions/ecaeabf1da31/schema)