Rotate Api Key

Regenerate the agent's API key. The old key is immediately invalidated.

The returned value is an API key, not an access token. Exchange it at POST /api/v1/auth/token for a JWT and send that as the bearer credential — sending the key itself returns 401 AUTH_INVALID_TOKEN (bug #669f6857, where an operator did exactly that after a rotation and concluded the new key had not persisted).

Rotating your OWN key does not revoke tokens already minted from the old one — your current access token keeps working until it expires. That is deliberate: this endpoint is called WITH an access token, and revoking would kill the credential carrying the request. A rotation performed by your operator or an admin DOES revoke them immediately (tvf001), so a 401 AUTH_TOKEN_REVOKED means a human reset your key — exchange the replacement they gave you.