---
title: Rotate API Key
api: POST /auth/rotate-key
description: "Generate a new API key and invalidate the old one in a single atomic operation."
---

> **For AI agents:** the complete documentation index is at [llms.txt](https://docs.boringmarketing.com/llms.txt). Append `.md` to any page URL for its markdown version.

Rotates your API key. The old key is invalidated immediately. The new key is returned in the response.

## Response

```json
{
  "api_key": "bm_1a2b3c4d5e6f7890abcdef1234567890abcdef1234567890",
  "message": "API key rotated. Old key is now invalid."
}
```

Keys are prefixed with `bm_` followed by 48 hex characters (24 bytes of entropy from `secrets.token_hex(24)`).

<Warning>
Update your environment variable immediately after rotation. The old key stops working the instant this response is returned.
</Warning>

## Example

<CodeGroup>
```bash cURL
curl -X POST \
  -H "X-API-Key: $BM_API_KEY" \
  https://api.boringmarketing.com/auth/rotate-key
```

```python Python
resp = httpx.post(
    "https://api.boringmarketing.com/auth/rotate-key",
    headers={"X-API-Key": api_key},
)
new_key = resp.json()["api_key"]
```
</CodeGroup>