Reroll Key

Generate a new API key while preserving the configuration from an existing key.

This operation creates a fresh key with a new token while maintaining all settings from the original key:

• Permissions and roles
• Custom metadata
• Rate limit configurations
• Identity associations
• Remaining credits
• Recovery settings

Key Generation:

• The system attempts to extract the prefix from the original key
• If prefix extraction fails, the default API prefix is used
• Key length follows the API's default byte configuration (or 16 bytes if not specified)

Original Key Handling:

• The original key will be revoked after the duration specified in expiration
• Set expiration to 0 to revoke immediately
• This allows for graceful key rotation with an overlap period

Common use cases include:

• Rotating keys for security compliance
• Issuing replacement keys for compromised credentials
• Creating backup keys with identical permissions

Important: Analytics and usage metrics are tracked at both the key level AND identity level. If the original key has an identity, the new key will inherit it, allowing you to track usage across both individual keys and the overall identity.

Required Permissions

Your credential must have:

• api.*.create_key or api.<api_id>.create_key
• unkey:v1:<workspace_id>:keyspaces/*#create_key or unkey:v1:<workspace_id>:keyspaces/<keyspace_id>#create_key
• api.*.encrypt_key or api.<api_id>.encrypt_key (only when the original key is recoverable)
• unkey:v1:<workspace_id>:keyspaces/*/keys/*#encrypt_key or unkey:v1:<workspace_id>:keyspaces/<keyspace_id>/keys/*#encrypt_key (only when the original key is recoverable)

{
  "keyId": "key_2cGKbMxRyIzhCxo1Idjz8q",
  "expiration": 86400000
}

{
  "meta": {
    "requestId": "req_123"
  },
  "data": {
    "keyId": "key_2cGKbMxRyIzhCxo1Idjz8q",
    "key": "prod_2cGKbMxRjIzhCxo1IdjH3arELti7Sdyc8w6XYbvtcyuBowPT"
  }
}