---
title: "Rotate Master Key"
method: POST
path: "/v1/settings/master-key/rotate"
tags: ["settings"]
---

# Rotate Master Key

`POST /v1/settings/master-key/rotate`

Regenerate the database-backed master key and invalidate the old one.

Only the first-run generated master key can be rotated here. When a master
key is supplied through config or ``OTARI_MASTER_KEY``, the dashboard cannot
invalidate it; the operator must change that value and restart instead.

Every dashboard session is revoked with the rotation (a session only proves
possession of the now-dead key); the caller's own session is re-minted under
the new key so the tab that performed the rotation stays signed in.

## Response `200`

Successful Response

- RotateMasterKeyResponse — A newly generated dashboard master key, returned once.
  - `master_key` string, required — The new plaintext master key. Store it now; it is never returned again.

---

[API](https://skmtc.net/mozilla-ai/apis/otari.md) · [All operations](https://skmtc.net/mozilla-ai/apis/otari/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mozilla-ai/otari/revisions/3945cde96091/schema)