---
title: Rotate API Key
protocol: rest
method: POST
endpoint: /v1/projects/{projectId}/api-keys/{keyId}/rotate
description: "Revoke a key and issue a replacement with the same name and scope."
---

# Rotate API Key

Atomically revokes an existing key and issues a new one with the same name, scope, and expiry. The old key stops working immediately.

<Endpoint method="POST" path="/v1/projects/{projectId}/api-keys/{keyId}/rotate" />

## Path Parameters

<ParamField path="projectId" type="string" required>
  The project ID.
</ParamField>

<ParamField path="keyId" type="string" required>
  The ID of the key to rotate.
</ParamField>

## Example

<CodeGroup>
```bash cURL
curl -X POST https://api.syntext.dev/v1/projects/prj_abc123/api-keys/key_789/rotate \
  -H "Authorization: Bearer stx_abc12345_..."
```

```typescript SDK
const newKey = await client.apiKeys.rotate('prj_abc123', 'key_789')
```
</CodeGroup>

### Response — 201 Created

```json
{
  "data": {
    "id": "key_790",
    "name": "CI deploy key",
    "key": "stx_e5f6g7h8_newFullKeyShownOnlyOnce",
    "prefix": "stx_e5f6g7h8",
    "scope": "build",
    "expiresAt": "2026-10-01T10:00:00Z",
    "createdAt": "2026-07-03T11:00:00Z",
    "previousKeyId": "key_789"
  }
}
```

<Warning>
Rotation is immediate — update the key everywhere it's used (CI secrets, environment variables) right away, since the old key is already revoked.
</Warning>

### 404 Not Found

Returned if the key doesn't exist, belongs to another project, or was already revoked.