# Rotate the API Key

Replace your tenant's API key. **The old key stops working at once**: every signed request still sending it is refused. For the Owner, Admin, Non-signing Admin and Security Admin roles.

## Overview

- The answer is your tenant with the new `apiKey` (as [Get the API Key](https://docs.aureahub.com/docs/admin-tenants-apikey.md)). The API secret does not change.
- Plan the switch first — [Credentials & Rotation](https://docs.aureahub.com/docs/guide-credentials.md) — and put the new key in your server's configuration right after.
- **Your tenant's quorum.** Where your tenant's quorum holds administrators' actions, this answers `202` `{ "state": "awaiting_quorum", "requestId" }` and nothing changes until another administrator approves it; you then read the new key once with [Read the Answer](https://docs.aureahub.com/docs/quorum-request-result.md). See [Your Tenant's Quorum](https://docs.aureahub.com/docs/guide-tenant-quorum.md).
- The rotation is written to your tenant's [audit trail](https://docs.aureahub.com/docs/audit-events.md) [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md).

## Endpoint

### `POST /v1/admin/tenants/{id}/rotate-key`

Authentication: bearer token required.

Replaces the tenant's API key; the old one is refused at once.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | yes | Your tenant's id |

**Responses**

`200` OK

```json
{
  "id": "3f1c9a52-6d1e-4c1b-9f0a-2a51e1c0b7d4",
  "name": "Acme Wallet",
  "apiKeyPrefix": "ak_live_",
  "configuration": { "walletMode": "custodial" },
  "status": "active",
  "logoUrl": null,
  "createdAt": "2026-03-02T09:14:07.000Z",
  "updatedAt": "2026-10-14T09:30:00.000Z",
  "apiKey": "ak_live_EXAMPLE000000000000000000000000000000000000000000000000000000002"
}
```

`202` Held for the Quorum

```json
{
  "state": "awaiting_quorum",
  "requestId": "4e2b9c17-8a3d-4f60-b5e1-7c9d0a2f6b38"
}
```

`403` Forbidden

```json
{
  "error": "ForbiddenError",
  "message": "Admin access required or you can only access your own tenant."
}
```

**Example request**

```bash
curl -X POST https://api.aureahub.com/v1/admin/tenants/TENANT_ID/rotate-key \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

---

Web version: https://docs.aureahub.com/#admin-tenants-rotatekey