---
title: "Rotate API key"
method: POST
path: "/api/secrets/api-key/rotate"
tags: ["Admin"]
---

# Rotate API key

`POST /api/secrets/api-key/rotate`

Rotate the project's admin API key. A new key is generated and returned; the old key stays valid for the grace period (default 24 hours, max 168 / 7 days) so in-flight requests finish gracefully. Admin only.

## Request body

- object
  - `gracePeriodHours` integer — How long the old key remains valid after rotation

## Response `200`

API key rotated successfully

- object
  - `success` boolean
  - `message` string
  - `apiKey` string — The new API key
  - `oldKeyExpiresAt` string, date-time — When the previous key stops being accepted

## Other responses

- `400` — Invalid grace period
- `401` — Unauthorized - missing or invalid admin token
- `403` — Forbidden - admin access required

---

[API](https://skmtc.net/insforge/apis/insforge-authentication-api.md) · [All operations](https://skmtc.net/insforge/apis/insforge-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/insforge/insforge-authentication-api/versions/a935bb49f932/schema)