---
title: "Rotate an app token (revoke old, create new) (v2, tenant actor)"
method: POST
path: "/v2/apps/{appId}/tokens/{tokenId}/rotate"
tags: ["Apps"]
---

# Rotate an app token (revoke old, create new) (v2, tenant actor)

`POST /v2/apps/{appId}/tokens/{tokenId}/rotate`

## Request

- Base URL: `https://api.chat.ethora.com`
- URL: `https://api.chat.ethora.com/v2/apps/{appId}/tokens/{tokenId}/rotate`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

**Auth**: Tenant Actor

Revokes the old token (best-effort) and returns a new token once.
Supports `User JWT` and `B2B Server JWT`.

## Path parameters

- `appId` string, required
- `tokenId` string, required

## Request body

- object
  - `label` string: Optional human-readable label for the rotated token (e.g. `prod-2026-07`). Stored on the token record.

## Response `200`

Success

- AppTokenRotateResponse
  - `ok` boolean, required
  - `appId` string, required
  - `revokedTokenId` string
  - `tokenId` string, required
  - `token` string, required: Returned once. Store securely.
  - `label` string, nullable
  - `createdAt` string, nullable

## Other responses

- `201`: created
- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `422`: Unprocessable Entity
- `500`: Internal Server Error

---

[API](https://skmtc.dev/ethora/apis/platform-api.md) · [All operations](https://skmtc.dev/ethora/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ethora/apis/platform-api/revisions/01b6e64378ee?raw)