PApaywithlocus
Tenants

Rotate every active key of a kind (cutover)

Creates ONE replacement and supersedes ALL other active keys of that kind. Requires a workspace owner or admin with credentials:manage and MFA or passkey step-up completed in the last ten minutes. A human caller cannot delegate a secret-key scope absent from their own effective membership scopes. For rotating a single key while its siblings keep working, use POST /credits/tenants/me/keys/{keyId}/rotate.

post/credits/tenants/me/keys/rotate

Request

  • Base URL
    https://api.paywithlocus.com/api
  • URL
    https://api.paywithlocus.com/api/credits/tenants/me/keys/rotate
  • Auth
    HTTP bearer

Headers

X-Locus-Step-Upstring password

Short-lived raw MFA/passkey step-up token bound to the authenticated Cognito subject. Send it alongside the dashboard Bearer token for workspace-administrator mutations when the base session does not itself prove MFA within the last ten minutes. Never send it with a tenant secret key.

Request body

kind'secret' | 'publishable' | 'sandbox' required
expiresIninteger nullable

Lifetime of the new key in seconds. Omit for the default.

scopesCreditsTenantScope[]

Scopes for the new key. Omit to keep the kind's defaults. Publishable keys accept only widget:read.

namestring

Name for the replacement key.

gracePeriodSecondsinteger

Keep the old key valid this long for zero-downtime cutover. Omitted means the old key dies with this response.

Response

{ success, kind, key, keyPrefix } — the raw key is returned exactly once. Unlike create and per-key rotation, this cutover endpoint returns keyPrefix rather than a keyMetadata object. Without gracePeriodSeconds the superseded keys stop working with this response; with it they keep authenticating until the overlap ends.

Changes

No recorded changes to this operation across all 1 revision of this API.