---
title: "Rotate the signing key"
method: POST
path: "/sandboxes/signing-key/rotate"
tags: ["Sandboxes"]
---

# Rotate the signing key

`POST /sandboxes/signing-key/rotate`

## Request

- Base URL: `https://api.hedra.com/v3`
- URL: `https://api.hedra.com/v3/sandboxes/signing-key/rotate`
- Auth: one of:
  - API key in header `Authorization`
  - HTTP bearer

Revoke every session JWT and endpoint token of your workspace's
sandboxes, every member's included; mint new ones after it answers. Only
a workspace owner or admin can rotate the key.

## Response `200`

Successful Response

- SandboxSigningKeyRotation: A rotation of the key that signs your workspace's session JWTs and endpoint tokens.
  - `rotated_at` string, date-time, required: When the new key took over. Every session JWT and endpoint token signed before it stops working within 30 seconds; a stream or request already open keeps running.

## Other responses

- `400`: Invalid or failed-validation request.
- `401`: Authentication failed: missing, malformed, or invalid credentials.
- `403`: Insufficient scope or plan. `PERMISSION_DENIED`: you are not an owner or admin of the workspace. A workspace service key never is.
- `404`: Your workspace has no sandbox account.
- `429`: Rate limit exceeded.
- `500`: Internal error.
- `503`: Sandboxes are temporarily unavailable, or are still being set up for your workspace; retry shortly.

## Changes

- **2026-10-23** `e733493214f4`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hedra-labs/apis/hedra-api/changes/sandboxes/signing-key/rotate/post.md)

---

[API](https://skmtc.dev/hedra-labs/apis/hedra-api.md) - [All operations](https://skmtc.dev/hedra-labs/apis/hedra-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hedra-labs/apis/hedra-api/revisions/6ef35a11cefe?raw)