---
title: "Rotate a single-owner Gateway Token"
method: POST
path: "/sites/{site_id}/gateways/{gateway_id}/token/rotate"
tags: ["Gateway Tokens"]
---

# Rotate a single-owner Gateway Token

`POST /sites/{site_id}/gateways/{gateway_id}/token/rotate`

Mints a replacement token for the gateway. A current token the gateway has connected with keeps working until the gateway first connects with the replacement or 4 hours elapse, whichever comes first; a token no gateway has ever connected with is replaced immediately. Rotating again before the gateway picks up the replacement replaces only the pending token and never invalidates the one in use. Once the replacement is confirmed the previous token is deleted - rolling the gateway's configuration back to it will strand the gateway.

## Path parameters

- `site_id` string, required
- `gateway_id` string, required

## Response `201`

New Token Response

- GatewayTokenResponse — Response schema for a new Gateway Token
  - `data` GatewayToken — Gateway Token
    - `id` string, uuid, required — Gateway Token ID
    - `token` string, required — Gateway Token

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `404` — Not Found
- `429` — Too Many Requests

---

[API](https://skmtc.dev/firezone/apis/firezone-api.md) · [All operations](https://skmtc.dev/firezone/apis/firezone-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/firezone/firezone-api/revisions/110de2cb2283/schema)