# Rotate API key

Rotates the secret API key for your account, generating a new key immediately. The previous key remains valid until expire_after_in_seconds has elapsed, giving you time to update your integrations. Once the expiry period passes, the old key is revoked and any requests using it will return 401 Unauthorized.

Endpoint: POST /api-keys/rotate
Version: 1.0.0
Security: JWT

## Request fields (application/json):

  - `expire_after_in_seconds` (integer, required)
    Duration (in seconds) for which the previous key remains valid after rotation. Must be an integer between 0 and 604800 (7 days). Use this window to update all integrations before the old key is revoked.
    Example: 3600

## Response 200 fields (application/json):

  - `secret_key` (string)
    The newly generated secret API key. Store it securely — it will not be shown again.
    Example: "<NEW_JWT>"

  - `previous_key_expires_at` (string)
    ISO 8601 timestamp (UTC) at which the previous key will be revoked.
    Example: "2026-05-13T12:10:57Z"

## Response 400 fields (application/json):

  - `error` (string)
    Enum: "Bad Request"

  - `message` (string)

## Response 401 fields (application/json):

  - `error` (string)
    Enum: "Unauthorized"

  - `message` (string)