---
title: "Rotate the agent-owned credential"
method: POST
path: "/credits/agent/credential/rotate"
tags: ["Agent-native onboarding"]
---

# Rotate the agent-owned credential

`POST /credits/agent/credential/rotate`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/agent/credential/rotate`
- Auth: HTTP bearer

Atomically replaces the account recovery digest and bearer credential from a newly generated 24-byte base64url token, then extends expiry by 365 days.

## Request body

- object
  - `registrationToken` string, required: Canonical base64url encoding of 24 bytes generated by a cryptographically secure random-number generator.

## Response `200`

Credential rotated and returned once

- AgentOwnedAccountEnvelope
  - `success` unknown, required
  - `account` AgentOwnedAccount, required
    - `id` string, uuid, required
    - `name` string, required
    - `status` string, required
    - `onboardingState` 'funding_required' | 'ready', required
    - `balance` AgentOwnedBalance, required
      - `usd` string, required: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
      - `credits` string, required: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
      - `creditsPerDollar` string, required
    - `connection` object, required
      - `id` string, uuid, required
      - `keyPrefix` string, required
      - `expiresAt` string, date-time, required
      - `credential` string: Returned on registration replay and rotation. Store immediately.
    - `identity` object, required
      - `provider` 'agentid', required
      - `email` string, email, required
    - `mcp` object, required
    - `links` object, required
    - `nextAction` object, required
    - `created` boolean
    - `credentialRenewed` boolean
    - `credentialRecovered` boolean
    - `activated` unknown, required

## Other responses

- `403`: Not the self-registered account credential
- `409`: Credential expired, changed concurrently, or replacement token already exists

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)