---
title: "Rotate Company Api Key"
method: POST
path: "/companies/{company_id}/api-key/rotate"
tags: ["companies"]
---

# Rotate Company Api Key

`POST /companies/{company_id}/api-key/rotate`

## Request

- Base URL: `https://api.nanocorp.so` (the document declares no server; this is the origin it was published from)
- URL: `https://api.nanocorp.so/companies/{company_id}/api-key/rotate`
- Auth: HTTP bearer

Rotate the company key (D-4): the old key stops working within the 60s
auth-cache TTL; the new one auto-cascades to the deployed site (env push +
production redeploy) and to the next sandbox launch. Human-only: no agent
surface exposes this.

## Path parameters

- `company_id` string, uuid, required

## Response `200`

Successful Response

- CompanyApiKeyResponse: The company's permanent API key (2026-08-07 spec §6). The raw ``token`` is returned to the owner on every read (D-9): it is the owner's own credential and every sandbox env already carries it. Responses are served with ``Cache-Control: no-store``.
  - `token` string, required
  - `key_prefix` string, required
  - `created_at` string, date-time, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/nanocorp/apis/nanocorp-api.md) - [All operations](https://skmtc.dev/nanocorp/apis/nanocorp-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nanocorp/apis/nanocorp-api/revisions/291bb76b720b?raw)