---
title: "Rotate Api Key Encryption"
method: POST
path: "/api/auth/api-key/rotate-encryption"
tags: ["auth"]
---

# Rotate Api Key Encryption

`POST /api/auth/api-key/rotate-encryption`

## Request

- Base URL: `https://fojin.app` (the document declares no server; this is the origin it was published from)
- URL: `https://fojin.app/api/auth/api-key/rotate-encryption`
- Auth: HTTP bearer

Re-encrypt the user's stored BYOK key under the current KDF.

Escape hatch for the v1→v2 migration: if the bulk migrate script
can't decrypt a row (because JWT_SECRET_KEY was rotated before this
fix landed), the row stays at v1 and chat returns "decrypt failed".
The user can re-save their key from the UI — but if they don't have
the plaintext anymore, this endpoint at least lets them confirm
they're already on v2.  Idempotent: a v2 row stays v2.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/fojin/apis/fojin-api-buddhist-digital-text-platform.md) · [All operations](https://skmtc.dev/fojin/apis/fojin-api-buddhist-digital-text-platform/llms.txt) · [OpenAPI document](https://skmtc.dev/fojin/apis/fojin-api-buddhist-digital-text-platform/revisions/969714238c61?raw)