LIlilt
API Keys

Rotate an API key

Changed on

Replace the prefix and secret of an existing API key, invalidating the previous secret and returning a new plaintext secret. The key's name and expiry are preserved.

The new secret is shown exactly once. Revoked keys cannot be rotated. The caller must own the key or hold apiKey.write on the current organization. The request body must be empty.

post/v2/api-keys/{id}/rotate

Request

  • Base URL
    https://api.lilt.com
  • URL
    https://api.lilt.com/v2/api-keys/{id}/rotate
  • Auth
    HTTP basic

Path parameters

idstring required

The API key's unique identifier.

Response

The rotated API key with its new plaintext secret (shown once only).

idstring required

The unique identifier for the API key.

namestring required

A human-readable label for the key.

prefixstring required

The first 8 characters of the key's random portion — the part that follows the lilt_ prefix. Safe to display.

keystring required

The full plaintext API key (lilt_ followed by 40 hex characters). Shown once only.

createdAtstring date-time required

ISO-8601 timestamp when the key was created.

expiresAtstring date-time nullable

ISO-8601 timestamp when the key expires, or null if it does not expire.

ownerEmailstring nullable

Email address of the user who owns the key. Returned when creating a key; omitted when rotating one.

ownerUserIdinteger nullable

Numeric identifier of the user who owns the key. Returned when creating a key; omitted when rotating one.

Example response

{
  "id": "uuid-1234",
  "name": "CI bot",
  "prefix": "aaaaaaaa",
  "key": "lilt_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
  "createdAt": "2026-04-29T00:00:00Z",
  "expiresAt": "2027-01-01T00:00:00Z",
  "ownerEmail": "developer@lilt.com",
  "ownerUserId": 42
}

Changes