---
title: "Rotate client secret for an API user"
method: POST
path: "/v2/api-users/rotate"
tags: ["API User"]
---

# Rotate client secret for an API user

`POST /v2/api-users/rotate`

Generates a new `clientSecret` for an existing API user. The old `clientSecret` is 
immediately invalidated and all existing access tokens for the API user will be expired.

**Use this endpoint to:**
- Rotate credentials as part of a regular security hygiene practice.
- Replace a `clientSecret` without deleting the API user.
- Generate a new `clientSecret` if the old secret was lost or not stored.

**Best practice:**
- Update your integrations with the new `clientSecret` immediately after rotation. Any authentication requests using the old secret will fail.

**Notes:**
- The new `clientSecret` is only returned once in the response and cannot be retrieved later. Store it securely.
- The `clientId` remains the same.
- The old `clientSecret` stops working immediately. Any integration using it will need to re-authenticate with the new secret.
- All existing access tokens created using the old `clientSecret` are immediately invalidated.
- Only a TMC admin can use this endpoint.

## Request body

- RotateClientSecretRequest
  - `clientId` string — Api user client id

## Response `200`

Client secret generated successfully

- RotateClientSecretResponse
  - `clientId` string — Api user client id
  - `clientSecret` string — Api user client secret

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Bad request

---

[API](https://skmtc.dev/spotnana/apis/auth-api.md) · [All operations](https://skmtc.dev/spotnana/apis/auth-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/spotnana/auth-api/revisions/555ac64fcc19/schema)