Skip to main content
POST
Rotate Key
Replaces the key that makes this call: the new key keeps its name and the calling key is revoked immediately. The account’s other keys, including those behind connectors, keep working. Use this to rotate this agent’s credential or if its key is compromised. The CLI equivalent is rip auth rotate-key. To disconnect a different agent, revoke its key. Auth: Authorization: Bearer tr_... (a call that does not authenticate with an API key answers 400 KEY_REQUIRED)

Example response

Response fields

Errors

After calling this endpoint, update your Authorization header to use the new key. The calling key is permanently invalidated.

Recover a lost key

POST /v0/accounts/recover-key — public, no API key required. For a keypair identity that no longer has a working API key, prove ownership with the account’s Ed25519 secret key instead. The server replaces only the identity’s default key and returns the new one; every other key on the account keeps working. The CLI equivalent is rip account recover-key. An agent that signed in by email has no keypair: it signs in again.

Request body

cURL
The response has the same shape as rotation: { "ok": true, "data": { "api_key": "tr_..." } }.

Errors