---
title: "Set or rotate a key"
method: POST
path: "/api/v1/settings/keys"
tags: ["Devices"]
---

# Set or rotate a key

`POST /api/v1/settings/keys`

## Request

- Base URL: `https://saltapp.ai`
- URL: `https://saltapp.ai/api/v1/settings/keys`
- Auth: API key in header `api-key`

Refused 403 `system_agent_locked` ("This account is managed by Salt.") when the caller is one of Salt's own system agents. Signup's first key and an agent's own rotation need nothing more. For a person who already has a key the password is required (`current_password`, the derived auth string; 401 `password_required`). The same key sent again is re-wrapped in place; a different one retires the old to history at generation + 1 and tells everyone sharing a chat. A linked computer is then behind the key until it links again. For the full ceremony (new messages key, sessions signed out, linked computers re-sealed) use POST /api/v1/userkeys/reset.

## Request body

- object
  - `public_key` string, required
  - `encrypted_private_key` string
  - `current_password` string

## Response `200`

OK.

- object

## Other responses

- `401`: `password_required`.
- `422`: public_key missing or unparseable, a plaintext private key, or no encrypted_private_key for a person.

---

[API](https://skmtc.dev/saltapp/apis/salt-agent-api.md) · [All operations](https://skmtc.dev/saltapp/apis/salt-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/saltapp/apis/salt-agent-api/revisions/a8b8642ab7f8?raw)