API keys

Rotate an API key's secret

A new secret for the same key; the old one stops working at once. The expiry is kept. Only the key's creator may rotate it; an expired key is 404.

post/o/{org}/api-keys/{key}/rotate

Request

  • Base URL: https://api.prix.dev
  • URL: https://api.prix.dev/o/{org}/api-keys/{key}/rotate
  • Auth: HTTP bearer

Response

The key, with its new secret.

idstring required

key_…; use it in the key routes.

kind'key' | 'oauth'

key is minted here; oauth is an MCP client a person connected by signing in. An oauth grant reaches only the MCP server, cannot be rotated and has no webhook; its expires_at is when it ends unless the client refreshes it.

namestring required
prefixstring required

The secret's first characters, to tell keys apart.

scopesApiKeyScope[] required
max_concurrentinteger required
webhook_urlstring nullable required
expires_atstring date-time nullable required
last_used_atstring date-time nullable required
created_atstring date-time required
secretstring required

The key's secret. Only in the create and rotate responses; never shown again.

webhook_secretstring

The webhook signing secret. Only in the update response that minted it.

Changes

No recorded changes to this operation across all 3 revisions of this API.