---
title: "Rotate a merchant's credentials"
method: POST
path: "/merchants/{username}/credentials/rotate"
tags: ["Merchants"]
---

# Rotate a merchant's credentials

`POST /merchants/{username}/credentials/rotate`

## Request

- Base URL: `https://gateway.pmnts.io/v2/partners`
- URL: `https://gateway.pmnts.io/v2/partners/merchants/{username}/credentials/rotate`
- Auth: HTTP basic

Rotates the merchant's API `token` and its `signing_secret`. No body is
expected. The fresh values are returned once — the previous token stops
working immediately, so the caller must store the response.

The response is a bare credentials object: `username`, `token`,
`signing_secret`, `rotated_at`.

## Response `200`

The rotated credentials (returned once).

- MerchantCredentials: Returned once by `POST /merchants/{username}/credentials/rotate`. The full `token` and `signing_secret` are shown here and never again.
  - `username` string, required: The merchant's username (e.g. `acme-store`).
  - `token` string, required: The newly-generated API token (e.g. `tok_live_3b9c1d…`).
  - `signing_secret` string, required: The newly-generated signing secret — the merchant's paynow/HMAC secret.
  - `rotated_at` string, date-time, required: When the credentials were rotated — ISO 8601 UTC (e.g. `2026-06-02T00:00:00Z`).

## Other responses

- `401`: Missing or invalid HTTP Basic credentials.
- `404`: Resource not found.

---

[API](https://skmtc.dev/fatzebra/apis/fat-zebra-partner-api.md) - [All operations](https://skmtc.dev/fatzebra/apis/fat-zebra-partner-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fatzebra/apis/fat-zebra-partner-api/revisions/10f1181ea916?raw)