---
title: "Rotate Jwt Key Route"
method: POST
path: "/api/admin/keys/rotate"
---

# Rotate Jwt Key Route

`POST /api/admin/keys/rotate`

## Request

- Base URL: `https://authyouragent.com` (the document declares no server; this is the origin it was published from)
- URL: `https://authyouragent.com/api/admin/keys/rotate`
- Auth: none declared

§10.6: rotate the signing key. The OLD kid stays in the keyset
(grace-retained, still published in /jwks, still verifiable) until its
grace window passes; new tokens are signed with the NEW kid. A site
refreshing JWKS from the cloud keeps verifying BOTH, so rotation is
zero-downtime. Admin-only (owner session, role='admin').

## Request body

- object

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/authyouragent/apis/auth-your-agent-cloud-slice.md) · [All operations](https://skmtc.dev/authyouragent/apis/auth-your-agent-cloud-slice/llms.txt) · [OpenAPI document](https://skmtc.dev/authyouragent/apis/auth-your-agent-cloud-slice/revisions/196372971a43?raw)