---
title: "Rotate an API key's secret"
method: POST
path: "/o/{org}/api-keys/{key}/rotate"
tags: ["API keys"]
---

# Rotate an API key's secret

`POST /o/{org}/api-keys/{key}/rotate`

## Request

- Base URL: `https://api.prix.dev`
- URL: `https://api.prix.dev/o/{org}/api-keys/{key}/rotate`
- Auth: HTTP bearer

A new secret for the same key; the old one stops working at once. The expiry is kept. Only the key's creator may rotate it; an expired key is `404`.

## Response `200`

The key, with its new secret.

- ApiKeyWithSecret: An `ApiKey` with its `secret`, as create and rotate return it. The secret is never shown again.
  - `id` string, required: `key_…`; use it in the key routes.
  - `kind` 'key' | 'oauth': `key` is minted here; `oauth` is an MCP client a person connected by signing in. An `oauth` grant reaches only the MCP server, cannot be rotated and has no webhook; its `expires_at` is when it ends unless the client refreshes it.
  - `name` string, required
  - `prefix` string, required: The secret's first characters, to tell keys apart.
  - `scopes` ApiKeyScope[], required
  - `max_concurrent` integer, required
  - `webhook_url` string, nullable, required
  - `expires_at` string, date-time, nullable, required
  - `created_by` object, required
    - `id` string, required
    - `email` string, nullable, required
  - `last_used_at` string, date-time, nullable, required
  - `created_at` string, date-time, required
  - `stats` object: The runs the key started in the last seven days. Only in the list. `finished` counts runs that ended `completed` or `needs_review`, out of `ended`. `webhook_deliveries` is the state of each run's latest completion webhook: delivered, still being retried, or dropped after the last try.
    - `since` string, date-time, required
    - `runs` integer, required
    - `finished` integer, required
    - `ended` integer, required
    - `spend_usd` number, required
    - `mcp_runs` integer, required: Of `runs`, those started through MCP.
    - `webhook_deliveries` object, required
      - `delivered` integer, required
      - `retrying` integer, required
      - `failed` integer, required
  - `secret` string, required: The key's secret. Only in the create and rotate responses; never shown again.
  - `webhook_secret` string: The webhook signing secret. Only in the update response that minted it.

## Other responses

- `401`: No bearer, an unknown, revoked or expired one, or an API key on a route keys cannot call.
- `404`: No such resource for the caller, including one in an org the caller is not in or a Project that is private to someone else.

---

[API](https://skmtc.dev/getrush/apis/rush-api.md) · [All operations](https://skmtc.dev/getrush/apis/rush-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getrush/apis/rush-api/revisions/05fb36ca864f?raw)