---
title: "Redeem a recovery code and rotate the API key"
method: POST
path: "/v1/auth/recover/confirm"
tags: ["auth"]
---

# Redeem a recovery code and rotate the API key

`POST /v1/auth/recover/confirm`

## Request

- Base URL: `https://api.strale.io`
- URL: `https://api.strale.io/v1/auth/recover/confirm`
- Auth: none declared

Redeems the single-use code sent by /v1/auth/recover. The previous API key stops working the moment this returns 200. Codes expire 30 minutes after issue. Requesting another does NOT invalidate an outstanding one — several can be live at once, each single-use — because an unauthenticated endpoint that invalidates a code on request lets anyone who knows the address keep cancelling a recovery in progress.

## Request body

- object
  - `email` string, email, required
  - `token` string, required: The code from the recovery email.

## Response `200`

Key rotated

- object
  - `api_key` string: Shown once. The previous key is now invalid.
  - `key_prefix` string
  - `message` string

## Other responses

- `400`: Both 'email' and 'token' are required.
- `401`: The code is invalid, expired, or already used.

---

[API](https://skmtc.dev/strale/apis/strale-api-2.md) · [All operations](https://skmtc.dev/strale/apis/strale-api-2/llms.txt) · [OpenAPI document](https://skmtc.dev/strale/apis/strale-api-2/revisions/a5293878cfc6?raw)