---
title: "Rotate a machine's secret key"
method: POST
path: "/machines/{machine_id}/secret_key/rotate"
tags: ["Machines"]
---

# Rotate a machine's secret key

`POST /machines/{machine_id}/secret_key/rotate`

Rotates the machine's secret key.
When the secret key is rotated, make sure to update it in your machine/application.
The previous secret key will remain valid for the duration specified by the previous_token_ttl parameter.

## Path parameters

- `machine_id` string, required

## Request body

- object
  - `previous_token_ttl` integer, required — The time in seconds that the previous secret key will remain valid after rotation. This ensures a graceful transition period for updating applications with the new secret key. Set to 0 to immediately expire the previous key. Maximum value is 8 hours (28800 seconds).

## Response `200`

Success

- object
  - `object` 'machine_secret_key', required — String representing the object's type.
  - `secret` string, required — The secret key for the machine.

## Other responses

- `400` — Request was not successful
- `401` — Authentication invalid
- `403` — Authorization invalid
- `404` — Resource not found
- `422` — Invalid request parameters

---

[API](https://skmtc.net/clerk/apis/clerk-backend-api.md) · [All operations](https://skmtc.net/clerk/apis/clerk-backend-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/clerk/clerk-backend-api/revisions/cf036e7951d3/schema)