---
title: "Rotate token credential"
method: POST
path: "/oauth2/tokens/{token}/rotate"
tags: ["OAuth2"]
---

# Rotate token credential

`POST /oauth2/tokens/{token}/rotate`

## Request

- Base URL: `https://api.payware.eu`
- URL: `https://api.payware.eu/oauth2/tokens/{token}/rotate`
- Auth: HTTP bearer

Generates a new token credential value and resets the expiration. The authorization grant (GRANTED status) is preserved. Only the ISV that owns the token can rotate it.

## Path parameters

- `token` string, required

## Response `200`

Token rotated successfully

- Oauth2Token: OAuth2 token response
  - `clientId` string: The merchant's partnerId
  - `accessToken` string: The access token
  - `tokenType` string: Token type. Only "bearer" is supported.
  - `expiresIn` integer, nullable: Seconds until this token credential stops being accepted, per the OAuth2 meaning of expires_in. A credential requested with POST /oauth2/tokens expires 180 days (by default) after the merchant grants authorization, and a rotated one 180 days after the rotation. NULL means the credential has no expiration date: credentials created by the invitation flow, the pre-provisioned sandbox test-merchant credentials, and legacy credentials issued before expiry was introduced, until they are rotated. 0 means already expired. Expiry ends the CREDENTIAL, not the merchant's authorization: rotate it (rotation works on an expired credential), or request a token again with the same client credentials, and if the authorization is still GRANTED a fresh credential is issued with no new merchant consent. Do not cache a credential indefinitely.
  - `scope` string: Granted scopes
  - `status` 'PENDING' | 'GRANTED' | 'REVOKED': Token status. Only GRANTED tokens are valid for API requests.

## Other responses

- `401`: Unauthenticated - missing, malformed or expired credentials
- `403`: Forbidden - the caller is authenticated but not permitted (plan or capability gate, KYC state, or tenant scope)
- `404`: Token not found or caller is not an ISV
- `429`: Too many requests - the caller exceeded its per-partner rate limit. Carries errorCode ERR_RATE_LIMIT_EXCEEDED and a Retry-After header, in seconds. The request was not processed, so the identical request is safe to retry once the window has passed.

---

[API](https://skmtc.dev/payware/apis/payware-api.md) · [All operations](https://skmtc.dev/payware/apis/payware-api/llms.txt) · [OpenAPI document](https://skmtc.dev/payware/apis/payware-api/revisions/7b3352ca947b?raw)