---
title: "Rotate this Code sign-in's routing-only key"
method: POST
path: "/code/router/keys"
---

# Rotate this Code sign-in's routing-only key

`POST /code/router/keys`

## Request

- Base URL: `https://api.caveman.so/api/v1`
- URL: `https://api.caveman.so/api/v1/code/router/keys`
- Auth: one of:
  - OAuth 2
    - Authorization code: `/api/v1/oauth/authorize`
    - Token URL: `/api/v1/oauth/token` scopes: `code:write`
  - HTTP bearer
  - API key in cookie `cave_access`
  - API key in cookie `__Secure-cave_identity.session_token`

POST /api/v1/code/router/keys on the Caveman Cloud control plane. Requires the code:write scope. Not exposed to autonomous agents: Mints a routing-only credential for a paid Caveman Code device sign-in. Agent and MCP sessions cannot widen their own access. Requires a live Code device session with code:write and a paid effective Cloud or Code plan, or enabled credits with a positive unreserved balance. No request body: tenant, user, session, project and scopes are server-derived. Returns the secret once. Repeating rotates the previous key; sign-out and device revocation revoke it. expires_at is the device session's expiry. Same control-plane IP, principal and organization rate limits as credits key minting. Read GET /auth/me plan and, when available, GET /code/credits plan, use_balance and balance_micros to offer Auto; this mint is authoritative.

## Response `201`

Routing key activated. Cache-Control: no-store. Store full_key securely; it cannot be read again.

- object
  - `id` string, uuid, required
  - `name` 'caveman-code-router', required
  - `key_prefix` string, required
  - `scopes` string[], required
  - `full_key` string, required: Returned once; store securely.
  - `created_at` string, date-time, required
  - `expires_at` string, date-time, required

## Other responses

- `401`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.
- `402`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.
- `403`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.
- `409`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.
- `429`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.
- `500`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.
- `503`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.
- `4XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.
- `5XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.

---

[API](https://skmtc.dev/caveman/apis/caveman-cloud-api.md) - [All operations](https://skmtc.dev/caveman/apis/caveman-cloud-api/llms.txt) - [OpenAPI document](https://skmtc.dev/caveman/apis/caveman-cloud-api/revisions/508312d01cfc?raw)