---
title: "Rotate an application's edge auth secret"
method: POST
path: "/applications/{id}/edge-secret:rotate"
tags: ["Applications"]
---

# Rotate an application's edge auth secret

`POST /applications/{id}/edge-secret:rotate`

## Request

- Base URL: `https://api.customdomain.ai/v1`
- URL: `https://api.customdomain.ai/v1/applications/{id}/edge-secret:rotate`
- Auth: HTTP bearer

Mints a new `edge_auth_secret` for the application and invalidates the previous one immediately. There is no overlap window, so the edge must be reconfigured with the returned value before it can authenticate again. Requires `app:write` (member and above); a widget token cannot call it. The secret is returned once and is not retrievable afterwards.

## Path parameters

- `id` string, required

## Response `200`

The new secret. Store it now; it is never shown again.

- object
  - `application_id` string, required
  - `edge_auth_secret` string, required: The new shared secret. Shown exactly once.

## Other responses

- `403`: Error envelope: {code, title, details}.
- `404`: Error envelope: {code, title, details}.

---

[API](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api.md) · [All operations](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/revisions/34d89cb7a7cd?raw)