Rotate the calling app's secret key
The calling app's secret key rotates ITSELF, and the new dd_sk_... is returned once — this is what makes scheduled credential rotation automatable instead of a dashboard click.
SELF-rotation only, deliberately. There is no create, list, or revoke-another-key on this API: key inventory stays behind a human dashboard session. A stolen dd_sk_ can already do everything the app can do until it is rotated, but it must not be able to mint a second, hidden credential that survives the owner rotating the one they know about. Rotating is, in effect, the revoke.
DEFAULT: no grace window. With no body (or overlapHours: 0) the previous key stops authenticating the instant this returns, so this response is the only copy of the new key — a caller that drops it has locked itself out of the API and must rotate again from the dashboard. A zero-overlap rotate also terminates any overlap window still live from an earlier rotation; rotating with the default is how you revoke a previous key early.
OPT-IN OVERLAP. {"overlapHours": 1} or {"overlapHours": 24} keeps the old key authenticating alongside the new one until previousKeyExpiresAt, so a rotator can deploy the new key with zero downtime. Exactly one previous key is ever kept: rotating again overwrites the slot and key n-1 dies instantly, regardless of remaining window. publicKey is echoed unchanged (it identifies the app in the widget and is never rotated here) so a CI job can assert it rewrote the right app.
Request
- Base URL: https://app.dodomain.io
- URL: https://app.dodomain.io/api/v1/keys/rotate
- Auth: HTTP bearer
Headers
The id of the team this call acts on, from GET /api/v1/teams. Needed only when the credential can use more than one team (an OAuth connection granted several); a secret key has exactly one. A team the credential cannot use is refused 404 TEAM_NOT_FOUND — the same answer whether the team exists or not.
Request body
Response
Success.
Changes
No recorded changes to this operation across all 1 revision of this API.