1. Docs
  2. API Reference
  3. Rotate an API key's secret

Rotate an API key's secret

POST/portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/api-keys/{id}/rotate-secret

Rotates the secret of an existing API key in place, minting a brand-new cnpy_-prefixed value for the same row while preserving its id, name, scopes, access_mode, expiry, and audit lineage. The previous secret is invalidated immediately and the new plaintext is returned exactly once in the key field. is_active is left untouched — rotating does not re-enable a disabled key. Returns 404 when no key with the given id exists in the active Environment.

Authentication

Bearer TokenAuthorization

JWT access token. Never send alongside X-API-Key: a request carrying both is refused.

Requires capability api_keys.manageDeveloper Console

Create, edit, rotate, and delete API keys. Granted through an administrator role in the Admin Workspace; a valid token without it is refused with 403.

Path Parameters

idstring Required

Responses

application/json

  • dataApiKeyCreatedResponseDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

Errors

When the request can't be completed, the response body includes a stable error code you can branch on.

403account.capability_requiredForbidden
When it happens

The signed-in user's administrator roles do not grant the capability this endpoint requires.

Remediation

Ask an account administrator to grant a role carrying the capability named in the Authentication section, then retry.

Returned object

ApiKeyCreatedResponseDtoView all properties on this resource
Request
curl -X POST "https://auth.canopy-io.com/portal/v1/accounts/{accountSlug}/applications/{appSlug}/environments/{envSlug}/api-keys/value/rotate-secret" \
  -H "Authorization: Bearer $CANOPY_TOKEN"
Response
{
  "data": {
    "id": "string",
    "name": "string",
    "description": "string",
    "key": "string",
    "key_preview": "string",
    "access_mode": "scoped",
    "scopes": [
      "string"
    ],
    "expires_at": "2026-04-20T12:00:00.000Z",
    "created_at": "2026-04-20T12:00:00.000Z"
  }
}
 Related endpoints
GETList API keys for Application
POSTCreate a new API key
GETList the permission scopes a scoped key can hold
GETActive/inactive API key counts for the environment
PATCHActivate or deactivate an API key
DELETEDelete an API key
 Was this page helpful?

Tell us how we can improve this guide.

Canopy