---
title: "Rotate the issuer signing key"
method: POST
path: "/v1/keys/rotate"
tags: ["Issuer Keys"]
---

# Rotate the issuer signing key

`POST /v1/keys/rotate`

Rotate the tenant's issuer signing key: mint a fresh active key for all future issuance and demote the previously active key to `rotated` with an overlapping-validity window (365 days) so credentials already issued under it keep verifying. Call it on a routine key-rotation schedule or in response to a suspected key compromise. Authenticated with the tenant API key.

## Response `200`

No response body

## Other responses

- `201` — Rotation succeeded. Returns the newly created active key, the demoted previous key (if one existed), and an impact summary describing how many in-force credentials remain verifiable under the rotated key.

---

[API](https://skmtc.dev/didit-protocol/apis/didit-credentials-api.md) · [All operations](https://skmtc.dev/didit-protocol/apis/didit-credentials-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/didit-protocol/didit-credentials-api/revisions/2eeb13158ffa/schema)