Sign in

v1

latestOpenAPI 3.0.32026-07-17183583.3 KB
ApiKeys

Rotate Issued API Key

Generates a new secret for an issued API key. Creates a new API key with a new key_id and secret, and immediately revokes the old key. This is the recommended way to update scopes, metadata, or rotate credentials.

For zero-downtime rotation, use this workflow instead:

  1. IssueApiKey with new credentials
  2. Deploy new secret to all services
  3. Verify new secret works everywhere
  4. AdminRevokeIssuedApiKey to remove the old key
POST /v2alpha1/admin/issuedApiKeys/01HQZX9VYQKJB8XQZQXQZQXQXQ:rotate
{
  "scopes": ["read"]
}
post/v2alpha1/admin/issuedApiKeys/{key_id}:rotate

Path parameters

key_idstring required

key_id is the ID of the existing API key to rotate

Request body

metadataobject

metadata for the new API key. Absent (nil) inherits from the old key; present (including empty Struct) overrides.

namestring

name for the new API key. Absent (HasName() == false) inherits from the old key; present (including empty string) overrides.

scopesstring[]

scopes for the new API key. Absent (nil slice) inherits from the old key; present (including empty list) overrides.

visibility'KEY_VISIBILITY_UNSPECIFIED' | 'KEY_VISIBILITY_SECRET' | 'KEY_VISIBILITY_PUBLIC'

KeyVisibility distinguishes public (client-safe) keys from secret (server-only) keys. Public keys use a different configurable prefix for visual distinction. Both types share the same scope/permission system — visibility is about exposure safety.

  • KEY_VISIBILITY_UNSPECIFIED: Treated as SECRET

Response

A successful response.

secretstring