---
title: "Exchange a recovery token for a new API key (single use)"
method: POST
path: "/api/rightos/organizations/recover/confirm"
tags: ["organizations"]
---

# Exchange a recovery token for a new API key (single use)

`POST /api/rightos/organizations/recover/confirm`

## Request

- Base URL: `https://rightos.i-s3.com`
- URL: `https://rightos.i-s3.com/api/rightos/organizations/recover/confirm`
- Auth: none required

Verifies the HMAC-signed recovery token from the email link and rotates the key. The new key is returned exactly once; the old key and any other outstanding recovery links are invalidated immediately.

## Request body

- object
  - `token` string, required

## Response `200`

New key (shown once)

- object
  - `ok` boolean
  - `apiKey` string

## Other responses

- `400`: Missing token
- `401`: Invalid or expired token
- `403`: Demo organization keys cannot be recovered
- `429`: Rate limited
- `503`: Recovery unavailable (email not configured)

---

[API](https://skmtc.dev/i-s3/apis/rightos-right-api.md) · [All operations](https://skmtc.dev/i-s3/apis/rightos-right-api/llms.txt) · [OpenAPI document](https://skmtc.dev/i-s3/apis/rightos-right-api/revisions/10020536e345?raw)