Sign in
User
API Credentials

Rotate one API credential

Atomically revokes the source and stores the encrypted one-time replacement response with the same transaction. An identical Idempotency-Key retry within 24 hours returns the same token without rotating again.

post/api/v1/user/api-credentials/{id}/rotate

Path parameters

idinteger required

Headers

X-CSRF-Tokenstring required

Fresh token returned by GET /api/v1/user/me for this authenticated session.

Idempotency-Keystring required

Required for account mutations that reveal a secret. Reuse the same key only for an identical payload. The encrypted response can be replayed for 24 hours; a changed payload or an expired key returns 409.

Request body

namestring
scopesstring[]
expires_atstring date-time nullable

Omitted preserves the current expiry; null resets to the standard 90-day expiry; maximum 366 days.

Response

Rotated, or the exact replacement token replayed for the same key and payload

oktrue required
tokenstring required

Visible only in the original create/rotate response and identical Idempotency-Key replays during the 24-hour recovery window; never recoverable through list/get.

token_visible_oncetrue required
replaced_credential_idinteger
idempotency_replayedboolean required
idempotency_expires_atinteger required

Unix timestamp for the encrypted replay window.

Changes

Changed in 1 of the 3 revisions of this API.1