Collect the replacement for the key you are calling with.

When we rotate a key (because it was exposed, or on request), the old key keeps working for a grace window and a successor is minted immediately. This endpoint hands that successor to whoever holds the current key, once, so a client can swap itself without a human copying a string out of an email:

r = requests.get(BASE + "/v1/key/successor",
                 headers={"X-API-Key": current_key})
if r.status_code == 200:
    save(r.json()["new_key"])     # use it from the next call onward

The secret is wiped on collection, so it exists at rest only between rotation and pickup. Free: rotating a credential should never cost credits.

200 with the new key, or 404 when there is nothing to collect (the normal case, so polling this is harmless).