---
title: "Generate or rotate the API key"
method: POST
path: "/auth/apikey"
tags: ["auth"]
---

# Generate or rotate the API key

`POST /auth/apikey`

Generates a fresh API key, replacing any existing one. The
returned key is shown only once; store it immediately.

Even when the request is authenticated via API key (Bearer), the
admin password must be supplied in the request body to prevent a
leaked key from rotating itself. The password check is skipped
when the server is started with `--disable-auth`.

## Request body

- object
  - `password` string — Admin password

## Response `200`

Success

- object
  - `key` string — The new API key (cleartext, shown once).

## Other responses

- `401` — Invalid admin password
- `403` — Forbidden in demo mode

---

[API](https://skmtc.net/evcc-io/apis/evcc.md) · [All operations](https://skmtc.net/evcc-io/apis/evcc/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/evcc-io/evcc/versions/7fa21d69a508/schema)