API referenceAPI keys
Rotate an API key
Rotate an API key
POST
/v1/projects/{projectId}/keys/{keyId}/rotateThis operation supports dashboard session-cookie authentication. Call it only from trusted server code; browsers must not manufacture or expose the session cookie.
Creates a replacement key with the same name and scopes and revokes the old key in the same transaction. Session-cookie auth only. Rate limit: 60 requests per 60 s per session.
Error codes: unauthorized (401), not_found (404),
already_revoked (409), key_generation_failed (500).
Authentication
- sessionCookie — Dashboard session cookie set by
POST /v1/auth/login. Video and playback endpoints additionally require theprojectIdquery parameter under cookie auth.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
projectId | path | string (Ulid) | Yes | — |
keyId | path | string (Ulid) | Yes | — |
Request body
This operation takes no request body.
Responses
| Status | Meaning |
|---|---|
201 | Replacement key. Store keyRaw now; it is never shown again. |
401 | No valid credential was presented. |
404 | The resource does not exist or is not visible to this caller. |
409 | The request conflicts with the resource's current state. The per-operation description lists the exact error.code values. |
429 | Rate limit exceeded. |
500 | The server failed to complete the request. |