---
title: "Create a New Client Token Version"
method: POST
path: "/client-tokens/{client-token-id}/rotate"
tags: ["clientTokenVersions"]
---

# Create a New Client Token Version

`POST /client-tokens/{client-token-id}/rotate`

## Request

- Base URL: `https://api.withpersona.com/api/v1`
- URL: `https://api.withpersona.com/api/v1/client-tokens/{client-token-id}/rotate`
- Auth: HTTP bearer

Rotates a Client Token by creating a new version without disabling existing versions. A Client Token can have up to five usable versions; disable an existing version before rotating if the limit has been reached. The new version's value is returned in the `included` response data. Copy the value when you create the version, then update your integrations to use it.

## Path parameters

- `client-token-id` string, required

## Query parameters

- `include` string
- `fields` object

## Headers

- `Key-Inflection` 'camel' | 'kebab' | 'snake'
- `Idempotency-Key` string
- `Persona-Version` '2026-09-29' | '2025-12-08' | '2025-10-27' | '2023-01-05' | '2022-09-01' | '2021-08-18' | '2021-07-05' | '2021-02-21' | '2020-05-18': Server API version. More info on versioning can be found [here](https://docs.withpersona.com/versioning).

## Request body

- object
  - `meta` ClientTokensClientTokenIdRotatePostRequestBodyContentApplicationJsonSchemaMeta
    - `expires-in-seconds` integer: The number of seconds until the new version expires. If omitted, falls back to the Client Token's `version-expires-in-seconds`, if set; otherwise the new version does not expire.

## Response `200`

This endpoint returns a Client Token.

- ClientTokenVersionsRotateClientTokenResponse200
  - `data` ClientToken, required: A Client Token resource
    - `type` 'client-token'
    - `id` string
    - `attributes` ClientTokenAttributes
      - `name` string: The name of the client token
      - `api-version` string, date: The Sentinel API version used by this client token. One of `2024-08-20` or `2026-10-01`.
      - `api-key-inflection` string: The key inflection used by this client token
      - `permissions` string[]: List of permissions granted to this client token
      - `domain-allowlist` string[]: List of domains allowed to use this client token
      - `allowed-resources` string[]: List of resources that this client token is authorized to manipulate
      - `version-expires-in-seconds` integer, nullable: How long newly minted client token versions live before expiring, in seconds (max 10 years). Null means new versions do not expire by default.
      - `disabled-at` string, date-time, nullable: When this client token was disabled
      - `disabled` boolean: Whether this client token is disabled
      - `created-at` string, date-time: When this client token was created
    - `relationships` ClientTokenRelationships
      - `versions` ClientTokenRelationshipsVersions
        - `data` ClientTokenRelationshipsVersionsDataItems[]
          - `type` 'client-token-version'
          - `id` string
  - `included` ClientTokenVersion[]
    - `type` 'client-token-version'
    - `id` string
    - `attributes` ClientTokenVersionAttributes
      - `value` string: The Client Token Version value, returned for a retrieved or newly created version. This should be treated with the utmost security.
      - `created-at` string, date-time: When this client token version was created
      - `expires-at` string, date-time, nullable: When this client token version expires
      - `status` string: The lifecycle status of this client token version: `active` or `disabled`.
    - `relationships` ClientTokenVersionRelationships
      - `client-token` ClientTokenVersionRelationshipsClientToken
        - `data` ClientTokenVersionRelationshipsClientTokenData
          - `type` 'client-token'
          - `id` string

## Other responses

- `400`: The request was unacceptable, often due to invalid parameters.
- `401`: An invalid API key was provided.
- `403`: The given API key doesn’t have permissions to perform the request or a quota has been exceeded.
- `404`: The requested resource doesn’t exist.
- `409`: The request conflicts with another request, often due to attempting to create a duplicate resource.
- `422`: The request modifies the resource in an unacceptable way, often due to an invalid action or parameter.
- `429`: Your organization’s rate limit has been exceeded. We recommend an exponential backoff on requests.

---

[API](https://skmtc.dev/withpersona/apis/withpersona-8.md) - [All operations](https://skmtc.dev/withpersona/apis/withpersona-8/llms.txt) - [OpenAPI document](https://skmtc.dev/withpersona/apis/withpersona-8/revisions/3683a7f9e1fe?raw)