---
title: "Rotate App Key"
method: POST
path: "/v2/appkeys/{key_id}/rotate"
tags: ["Token"]
---

# Rotate App Key

`POST /v2/appkeys/{key_id}/rotate`

## Request

- Base URL: `https://api.loyalty.dog`
- URL: `https://api.loyalty.dog/v2/appkeys/{key_id}/rotate`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/loyalty/apis/loyaltydog/docs/v2/appkeys/:key_id/rotate/post.ts> (a function with typed inputs; its response is checked against the schema)

Mint a new hashed public-key secret for the same AccessToken id.

Dashboard getTempApiToken (iss loyalty.dog, token_use=session) is the
merchant store-owner caller — the same contract as POST /appkeys.
User.admin is the staff flag and is not required for that dashboard token.
Dashboard / admin session JWT only — not the public key itself.
Optional ``overlapSeconds`` keeps the previous hash valid until that window ends.
JWT app keys: create a new key via POST /appkeys and delete the old one (dashboard).
The new secret is returned once.

## Path parameters

- `key_id` string, required

## Headers

- `authorization` string, nullable

## Request body

- AppKeyRotateRequest: Optional overlap window for hashed public keys (SWE-1140). JWT rotate is not this endpoint.
  - `overlapSeconds` integer

## Response `200`

Successful Response

- AppKeyRotateResponse
  - `id` string, required
  - `token` string, required
  - `expiresAt` string, date-time, nullable
  - `last4` string, nullable
  - `keyPrefix` string, nullable
  - `previousHashExpiresAt` string, date-time, nullable

## Other responses

- `422`: Validation Error

## Changes

- **2026-09-08** `a15e6601ef8d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/loyalty/apis/loyaltydog/changes/v2/appkeys/:key_id/rotate/post.md)

---

[API](https://skmtc.dev/loyalty/apis/loyaltydog.md) - [All operations](https://skmtc.dev/loyalty/apis/loyaltydog/llms.txt) - [OpenAPI document](https://skmtc.dev/loyalty/apis/loyaltydog/revisions/5803242b0551?raw)