---
title: Rotate a live workspace API key
description: Session-only, owner/admin.
api_method: POST
api_path: "/v1/workspaces/{workspaceId}/api-keys/{keyId}/rotate"
canonical_url: https://wiblo.app/docs/developers/api/api-keys/rotate-api-key
last_updated: 2026-07-28T17:31:44+02:00
md_url: https://wiblo.app/docs/developers/api/api-keys/rotate-api-key.md
---

# Rotate a live workspace API key

`POST /v1/workspaces/{workspaceId}/api-keys/{keyId}/rotate`

Session-only, owner/admin. Creates a new key under the same integration with the same role cap and returns the new raw `access_key`; the old key keeps working until the caller revokes it. Only `live` keys can be rotated. Per-workspace rate-limited at 5 rotations / 10 minutes.

## Path parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `workspaceId` | `string` | Yes |  |
| `keyId` | `string` | Yes |  |

## Request

**curl**

```bash
curl https://api.wiblo.app/v1/workspaces/{workspaceId}/api-keys/{keyId}/rotate \
  -X POST \
  -H "Authorization: Bearer $WIBLO_TOKEN"
```

**TypeScript**

```ts
import { createSdk, rotateApiKey } from "@workspace/sdk"

const sdk = createSdk({ baseUrl: "https://api.wiblo.app" })

const { data, error } = await rotateApiKey({
  client: sdk,
  path: { workspaceId: "...", keyId: "..." },
})
```

## Responses

**`200`** — A new key was issued; `access_key` is shown once. Returns `RotateApiKeyResponse`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `access_key` | `string` | Yes |  |
| `id` | `string` | Yes |  |
| `member_id` | `string` | Yes |  |
| `key_prefix` | `string` | Yes |  |
| `role_cap` | `"admin" \| "member"` | Yes |  |
| `expires_at` | `string \| null` | Yes |  |

**`401`** — No valid Supabase session cookie was present. Returns `ApiErrorEnvelope`.

**`403`** — Caller is not an owner/admin, or a `wbl_*` bearer was presented (`INSUFFICIENT_PRIVILEGE`). Returns `ApiErrorEnvelope`.

**`404`** — The key does not exist in this workspace (`API_KEY_NOT_FOUND`), or the caller has no membership / the workspace does not exist (`WORKSPACE_NOT_FOUND`). Returns `ApiErrorEnvelope`.

**`422`** — Path param failed UUID validation (`INVALID_PARAMS`), or the target key is not `live` (`KEY_NOT_LIVE`). Returns `ApiErrorEnvelope`.

**`429`** — Rate limit exceeded. The body's `error.code` is `RATE_LIMITED` and `error.details.retry_after` is the same number of seconds as the `Retry-After` header. Returns `ApiErrorEnvelope`.