Rotate an API key

POST /api/api-keys/{id}/rotate deprecated

Requires: ApiKeyAuthorization.ApiKeys, merchant scope.

Mints a replacement owned by the same user and merchant, with the same access, and returns it with its value revealed. This is the only time that value is shown. The key being rotated keeps authenticating for an overlap window (24 hours by default, seven days at most) so the integration can deploy the replacement without an outage, and is then refused with KEY_REVOKED. To end the overlap sooner, revoke the rotated key: that takes effect on the very next request. Gated on the same permission as revoke, because it is the same decision about the same credential. Refused for a key that has already been revoked or already been rotated.

Signed in, you can send this request to your own sandbox merchant from the console and read the answer. Sign in to try it.

Example request

Every block below sends the same request. Replace {{BASE_URL}} with the address of the API you are calling and {{API_KEY}} with your own key.

The request body is a RotateApiKeyDto. See the Request body section below for its fields.

cURL PowerShell TypeScript C# Python

cURL

curl -X POST "{{BASE_URL}}/api/api-keys/{id}/rotate" \
  -H "api-key: {{API_KEY}}" \
  -H "Content-Type: application/json" \
  -d '{
  "overlapHours": 0,
  "expireAt": "2026-01-01T00:00:00Z",
  "reason": ""
}'

PowerShell

$headers = @{
    'api-key' = '{{API_KEY}}'
}

$body = @'
{
  "overlapHours": 0,
  "expireAt": "2026-01-01T00:00:00Z",
  "reason": ""
}
'@

$response = Invoke-RestMethod -Method POST -Uri '{{BASE_URL}}/api/api-keys/{id}/rotate' `
    -Headers $headers -ContentType 'application/json' -Body $body

npm install @winkpg/winkpg-api

TypeScript (SDK)

import { Configuration, APIKeysApi } from '@winkpg/winkpg-api';

const api = new APIKeysApi(new Configuration({
  basePath: '{{BASE_URL}}',
  apiKey: '{{API_KEY}}',
}));

const { data } = await api.apiKeysRotate("3fa85f64-5717-4562-b3fc-2c963f66afa6", {
  "overlapHours": 0,
  "expireAt": "2026-01-01T00:00:00Z",
  "reason": ""
});

TypeScript (raw HTTP)

const response = await fetch('{{BASE_URL}}/api/api-keys/{id}/rotate', {
  method: 'POST',
  headers: {
    "api-key": "{{API_KEY}}",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "overlapHours": 0,
    "expireAt": "2026-01-01T00:00:00Z",
    "reason": ""
  }),
});

const data = await response.json();

dotnet add package WinkPg.Api.Client

C# (SDK)

using WinkPg.Api.Client.Api;
using WinkPg.Api.Client.Client;
using System.Text.Json;

var config = new Configuration { BasePath = "{{BASE_URL}}" };
config.AddApiKey("api-key", "{{API_KEY}}");

var api = new APIKeysApi(config);
var body = JsonSerializer.Deserialize<RotateApiKeyDto>("""
    {
      "overlapHours": 0,
      "expireAt": "2026-01-01T00:00:00Z",
      "reason": ""
    }
    """);

var result = await api.ApiKeysRotateAsync(Guid.Parse("3fa85f64-5717-4562-b3fc-2c963f66afa6"), body);

C# (raw HTTP)

using System.Text;

using var http = new HttpClient { BaseAddress = new Uri("{{BASE_URL}}") };

var request = new HttpRequestMessage(new HttpMethod("POST"), "/api/api-keys/{id}/rotate");
request.Headers.Add("api-key", "{{API_KEY}}");

request.Content = new StringContent("""
    {
      "overlapHours": 0,
      "expireAt": "2026-01-01T00:00:00Z",
      "reason": ""
    }
    """, Encoding.UTF8, "application/json");

var response = await http.SendAsync(request);
response.EnsureSuccessStatusCode();
var json = await response.Content.ReadAsStringAsync();

pip install winkpg-api

Python (SDK)

import winkpg_api

configuration = winkpg_api.Configuration(host="{{BASE_URL}}")
configuration.api_key["ApiKey"] = "{{API_KEY}}"

with winkpg_api.ApiClient(configuration) as client:
    api = winkpg_api.APIKeysApi(client)
    body = winkpg_api.RotateApiKeyDto.from_dict({
      "overlapHours": 0,
      "expireAt": "2026-01-01T00:00:00Z",
      "reason": ""
    })
    result = api.api_keys_rotate("3fa85f64-5717-4562-b3fc-2c963f66afa6", body)

pip install requests

Python (raw HTTP)

import requests

headers = {
    "api-key": "{{API_KEY}}",
    "Content-Type": "application/json",
}

body = {
  "overlapHours": 0,
  "expireAt": "2026-01-01T00:00:00Z",
  "reason": ""
}

response = requests.request(
    "POST",
    "{{BASE_URL}}/api/api-keys/{id}/rotate",
    headers=headers,
    json=body,
)
response.raise_for_status()
data = response.json()

Parameters

Name	In	Type	Description
`id` required	path	string (uuid)
`suppressNulls` required	query	boolean	If true, omit properties with null values.

Request body

application/json , required

Field	Type	Description
`overlapHours` required	integer (int32)	How many hours the replaced key should keep authenticating, or `null` for the configured default (24 hours). nullablemin 0
`expireAt` required	string (date-time)	When the replacement should expire, or `null` to give it the same term the replaced key was originally granted, measured from now. nullable
`reason` required	string	A reason recorded against the replaced key, used only when the rotation cuts over immediately and therefore revokes it in the same operation. nullablemax length 256

This request body has no documented fields.