---
title: "Rotate Key"
method: POST
path: "/keys/{key_id}/rotate"
tags: ["Access"]
---

# Rotate Key

`POST /keys/{key_id}/rotate`

## Request

- Base URL: `https://api.hedra.com/v3`
- URL: `https://api.hedra.com/v3/keys/{key_id}/rotate`
- Auth: one of:
  - API key in header `Authorization`
  - HTTP bearer

## Path parameters

- `key_id` string, required: The key's public identifier.

## Request body

- KeyRotateRequest
  - `grace_period_seconds` integer, nullable: Seconds the old secret keeps authenticating after the rotation; omitted means the service default (24h).

## Response `200`

Successful Response

- KeyRotateResponse
  - `key_id` string, required: The key's public identifier — unchanged by rotation.
  - `credential` string, required: The new `<key_id>:<secret>` pair — a valid Bearer credential, shown exactly once, like at create.
  - `kind` 'personal' | 'service', required: Personal keys die with the member; service keys belong to the workspace.
  - `name` string, nullable: Human-readable label for the key.
  - `scopes` string[], nullable: Scopes granted to the key; null means every scope except the opt-in `sandboxes:read`, `sandboxes:write` and `sandboxes:exec` (a legacy key predating scopes).
  - `workspace_id` string, nullable: The workspace the key bills and acts in.
  - `expires_at` string, date-time, nullable: ISO-8601 instant the key stops authenticating; null means it never expires.
  - `previous_secret_expires_at` string, date-time, nullable: ISO-8601 instant the previous secret stops authenticating — the end of the grace window.

## Other responses

- `400`: Invalid or failed-validation request.
- `401`: Authentication failed: missing, malformed, or invalid credentials.
- `403`: Insufficient scope or plan.
- `404`: Resource not found.
- `429`: Rate limit exceeded.
- `500`: Internal error.

## Changes

- **2026-10-16** `06692d16e78a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hedra-labs/apis/hedra-api/changes/keys/:key_id/rotate/post.md)

---

[API](https://skmtc.dev/hedra-labs/apis/hedra-api.md) - [All operations](https://skmtc.dev/hedra-labs/apis/hedra-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hedra-labs/apis/hedra-api/revisions/6ef35a11cefe?raw)