API referenceProjects
Rotate the project's embed token key
Rotate the project's embed token key
POST
/v1/projects/{id}/security-settings/rotate-embed-keyThis operation supports dashboard session-cookie authentication. Call it only from trusted server code; browsers must not manufacture or expose the session cookie.
Replaces the embed token key immediately: tokens signed with the old key stop verifying on the spot, and every embed URL must be re-signed with the returned key. Session-cookie auth only. Rate limit: 10 requests per 60 s per session.
Error codes: unauthorized (401), not_found (404),
embed_tokens_unconfigured (503).
Authentication
- sessionCookie — Dashboard session cookie set by
POST /v1/auth/login. Video and playback endpoints additionally require theprojectIdquery parameter under cookie auth.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string (Ulid) | Yes | — |
Request body
This operation takes no request body.
Responses
| Status | Meaning |
|---|---|
200 | The new raw embed token key. |
401 | No valid credential was presented. |
404 | The resource does not exist or is not visible to this caller. |
429 | Rate limit exceeded. |
503 | Embed token verification is not configured on this API. |