---
title: "Tunnel Rotate Token"
method: POST
path: "/tunnel/rotate"
---

# Tunnel Rotate Token

`POST /tunnel/rotate`

## Request

- Base URL: `https://api.local-mcp.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.local-mcp.com/tunnel/rotate`
- Auth: none declared

Rotates a tunnel token: revokes the PRESENTED token and issues a replacement with the
same identity (email/license/machine), settings, approval and last-seen time. The token is the credential (same trust
model as /tunnel/data-enable): only its holder can rotate it, and it rotates only itself. Old
token stops working immediately; the local server must be given the new token (config.json
cloud_token) and restarted.

lmcp-api#262: this used to revoke EVERY live token of the presented token's machine. A machine
id is not a secret and register-anon mints a token for any machine id without authentication,
so anyone could cut a machine off (its approved token, its web-AI connectors) and receive a
fresh token of that machine, which a grandfathered key (routing_bound false) then routed on. A
token proves nothing about its siblings, so it cannot revoke them. The response shape is
unchanged: the caller sends {token} and reads `token` (the Mac tray,
MenuBarView.rotateCloudToken; any client may call it under
contracts/relay-token-rotate.v1.json).

## Request body

- TunnelRotateRequest
  - `token` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/local-mcp/apis/lmcp-api.md) · [All operations](https://skmtc.dev/local-mcp/apis/lmcp-api/llms.txt) · [OpenAPI document](https://skmtc.dev/local-mcp/apis/lmcp-api/revisions/f1f1c502623a?raw)