---
title: "Rotate API Key"
method: POST
path: "/api_keys/{id}/rotate"
tags: ["API Keys"]
---

# Rotate API Key

`POST /api_keys/{id}/rotate`

Rotates the API key's secret, invalidating the previous secret immediately. The response is the only place the new `secret_key` is returned.

## Headers

- `Idempotency-Key` string

## Response `200`

api key rotated

- ApiKey
  - `api_version_date` '2025-01-01' | '2026-06-08' | '2026-06-09' | '2026-06-20' | '2026-07-01' | '2026-07-08' | '2026-07-08-1' | '2026-07-18' | '2026-07-20' | '2026-07-22' | '2026-07-23' | '2026-07-25' | '2026-07-26' | '2026-07-27' | '2026-07-29' | '2026-07-29-1' | '2026-07-31' | '2026-08-03' | '2026-08-05' | '2026-08-05-1', required — Dated API version used when requests authenticated with this key omit the `Api-Version-Date` header.
  - `created_at` string, required — When the API key was created, as an ISO 8601 timestamp.
  - `expires_at` string, nullable, required — When the API key stops working, as an ISO 8601 timestamp. `null` means it never expires.
  - `grants` ApiKeyGrant[]
    - `actions` ApiKeyGrantAction[], required
      - `action` string, required — The permission action's identifier, for example `company:basic:read`.
      - `granted` boolean, required — Whether the key holds the action on the grant's resource.
    - `resource_id` string, required — ID of the resource the actions apply to.
    - `resource_type` string, required — The type of resource the actions apply to, such as `account`, `product`, or `app`.
  - `id` string, required — API key ID, prefixed `apik_`.
  - `ip_allowlist` string[], nullable, required
  - `is_default_for_resource` boolean, required — Whether this is the resource's default API key. Default keys cannot be updated or deleted, only rotated.
  - `name` string, nullable, required — Human-readable name identifying the API key, or `null` when none was set.
  - `obfuscated_secret_key` string, required — Masked version of the secret key, so the key can be recognized without revealing the full secret.
  - `secret_key` string — The full secret used to authenticate requests. Returned only once, on create and rotate responses — store it immediately.
  - `system_role` 'owner' | 'admin' | 'moderator' | 'sales_manager' | 'advertiser' | 'null', nullable, required — System role the key inherits its permissions from, or `null` when it uses an explicit permissions policy. Only account API keys can use a system role.
  - `updated_at` string, required — When the API key was last updated, as an ISO 8601 timestamp.

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Resource not found

---

[API](https://skmtc.net/whop/apis/whop-api.md) · [All operations](https://skmtc.net/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/whop/whop-api/versions/866821546d67/schema)