LOloyalty
Token

Rotate App Key

Changed on

Mint a new hashed public-key secret for the same AccessToken id.

Dashboard getTempApiToken (iss loyalty.dog, token_use=session) is the merchant store-owner caller — the same contract as POST /appkeys. User.admin is the staff flag and is not required for that dashboard token. Dashboard / admin session JWT only — not the public key itself. Optional overlapSeconds keeps the previous hash valid until that window ends. JWT app keys: create a new key via POST /appkeys and delete the old one (dashboard). The new secret is returned once.

post/v2/appkeys/{key_id}/rotate

Request

Path parameters

key_idstring required
Example:5eb7cf5a86d9755df3a6c593

Headers

authorizationstring nullable

Request body

overlapSecondsinteger

Response

Successful Response

idstring required
tokenstring required
expiresAtstring date-time nullable
last4string nullable
keyPrefixstring nullable
previousHashExpiresAtstring date-time nullable

Example response

{
  "id": "5eb7cf5a86d9755df3a6c593"
}

Changes