API

Rotate API Key

Atomically revokes an existing key and issues a new one with the same name, scope, and expiry. The old key stops working immediately.

POST/v1/projects/{projectId}/api-keys/{keyId}/rotate

Path Parameters

The project ID.

The ID of the key to rotate.

Example

curl -X POST https://api.syntext.dev/v1/projects/prj_abc123/api-keys/key_789/rotate \
-H "Authorization: Bearer stx_abc12345_..."

const newKey = await client.apiKeys.rotate('prj_abc123', 'key_789')

Response — 201 Created

{
  "data": {
    "id": "key_790",
    "name": "CI deploy key",
    "key": "stx_e5f6g7h8_newFullKeyShownOnlyOnce",
    "prefix": "stx_e5f6g7h8",
    "scope": "build",
    "expiresAt": "2026-10-01T10:00:00Z",
    "createdAt": "2026-07-03T11:00:00Z",
    "previousKeyId": "key_789"
  }
}

Rotation is immediate — update the key everywhere it's used (CI secrets, environment variables) right away, since the old key is already revoked.

404 Not Found

Returned if the key doesn't exist, belongs to another project, or was already revoked.

Was this page helpful?