---
title: "Rotate the calling application's EC keypair"
method: POST
path: "/v1/applications/keys/rotate"
tags: ["Authentication", "Encryption"]
---

# Rotate the calling application's EC keypair

`POST /v1/applications/keys/rotate`

Generates a fresh EC P-256 keypair for the authenticated application and
returns the new public key (JWK) and private key material (`appPrivateJwk`).

**The private JWK is returned only once** - store it securely.
After rotation:
- IDaaS will encrypt all outbound webhooks with the **new** public key.
- Requests encrypted with the **old** public key will be rejected (Content-Encryption: JWE decryption will fail).
- Allow a brief migration window for in-flight messages before destroying the old private key.

The `keyVersion` field is incremented on each rotation.

## Response `200`

Keypair rotated - new key material returned

## Other responses

- `401` — Missing or invalid bearer token
- `500` — Keypair rotation failed

---

[API](https://skmtc.net/reflexpay/apis/idaas-identity-as-a-service-api.md) · [All operations](https://skmtc.net/reflexpay/apis/idaas-identity-as-a-service-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/reflexpay/idaas-identity-as-a-service-api/revisions/db1f954badfb/schema)