---
title: "Reencrypt Stored Provider Keys"
method: POST
path: "/v1/provider-credentials/reencrypt"
tags: ["providers"]
---

# Reencrypt Stored Provider Keys

`POST /v1/provider-credentials/reencrypt`

Re-encrypt stored provider keys with the primary OTARI_SECRET_KEY.

Operators rotate ``OTARI_SECRET_KEY`` by setting it to ``new,old`` first,
restarting, running this endpoint, then removing the old key and restarting
again. Rows that cannot be decrypted are left untouched and must be recovered
by replacing the affected provider keys.

## Response `200`

Successful Response

- ReencryptProviderCredentialsResponse — Result of re-encrypting stored provider keys with the primary secret key.
  - `reencrypted` integer, required — Number of stored provider keys re-encrypted.
  - `unreadable` integer, required — Number of encrypted keys left untouched because they could not be decrypted.

## Changes

- **2026-07-22** `34a9079fbd10` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/mozilla-ai/apis/otari/changes/v1/provider-credentials/reencrypt/post.md)

---

[API](https://skmtc.dev/mozilla-ai/apis/otari.md) · [All operations](https://skmtc.dev/mozilla-ai/apis/otari/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mozilla-ai/otari/revisions/7f178e92b56c/schema)