---
title: "Rotate the secret on an application"
method: POST
path: "/applications/{appId}/secret"
tags: ["Application"]
---

# Rotate the secret on an application

`POST /applications/{appId}/secret`

The response of this request is a bit misleading. We don't ever get your application secret, that is 100% generated by you. <code>new_secret</code> is just the public key returned back to you as a confirmation we got it.

## Path parameters

- `appId` string, required

## Query parameters

- `appPublicKey` string, required

## Response `200`

Updated secret

- object
  - `new_secret` string

## Other responses

- `400` — Missing <code>appPublicKey</code> query parameter
- `401` — Unauthorized. No UUID in internal session
- `403` — You do not own this application
- `404` — Application not found

---

[API](https://skmtc.net/minecraftauthentication/apis/internal-api.md) · [All operations](https://skmtc.net/minecraftauthentication/apis/internal-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/minecraftauthentication/internal-api/versions/21fb95c12d10/schema)