API Keys

Create a replacement key and schedule old-key revocation

The old key remains active during a bounded overlap window. Omitting revokeOldAt uses a 24-hour overlap, capped by the old key expiry. An explicit value must be in the future, no more than seven days from the request, and no later than the old key expiry. Internal primary and retiring rotation states are not exposed as public API Key statuses.

post/api-keys/{keyId}/rotate

Request

  • Base URL: https://api.flashdata.dev/v2
  • URL: https://api.flashdata.dev/v2/api-keys/{keyId}/rotate
  • Auth: API key in cookie __Host-fd_session and API key in header X-CSRF-Token

Path parameters

keyIdstring required

Headers

Idempotency-Keystring required

Request body

revokeOldAtstring date-time

Optional old-key revocation time; defaults to 24 hours and cannot exceed seven days or the old key expiry.

Response

Replacement created; secret returned once

secretstring required

Plaintext secret returned only by this create/rotate transaction. Newly issued secrets use the fd_ prefix. Previously issued fd_test_ and fd_live_ secrets still authenticate. An authenticated replay with the same Idempotency-Key and request body may receive the same KMS-encrypted response for five minutes; it is not recoverable afterward.

Changes

No recorded changes to this operation across all 1 revision of this API.