---
title: "Rotate an MCP staff key (new value shown once)"
description: "Generates a new key value, replaces key_hash and key_prefix, and returns the plaintext once.\nThe old value stops working immediately. Active state, grants and expiry are unchanged.\nAllowed for a platform owner, or for the platform admin who created the key when the key is\nneither global nor holds any write grant. A concurrent rotation answers 409.\n"
---

> Documentation Index
> Fetch the complete documentation index at: https://developer.channelautomations.com/llms.txt
> Use this file to discover all available pages before exploring further.

Path: Channel Automation API › Platform Admin

`POST /api/admin/mcp-permissions/keys/{keyId}/rotate`

Generates a new key value, replaces key_hash and key_prefix, and returns the plaintext once.
The old value stops working immediately. Active state, grants and expiry are unchanged.
Allowed for a platform owner, or for the platform admin who created the key when the key is
neither global nor holds any write grant. A concurrent rotation answers 409.

## Authentication

- `BearerAuth`, http, header `Authorization`, format `JWT`

## Path parameters

- `keyId` (`post/api/admin/mcp-permissions/keys/keyId/rotate.path.keyId`; string, required)
  - format `uuid`

## Code samples

### cURL

```bash
curl --request POST \
  --url 'https://api.channelautomation.com/api/admin/mcp-permissions/keys/<keyId>/rotate' \
  --header 'Authorization: Bearer <token>'
```

### TypeScript

```typescript
const url = 'https://api.channelautomation.com/api/admin/mcp-permissions/keys/<keyId>/rotate';
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch(url, options)
  .then(res => res.json())
  .then(json => console.log(json))
  .catch(err => console.error(err));
```

### Python

```python
import requests

url = "https://api.channelautomation.com/api/admin/mcp-permissions/keys/<keyId>/rotate"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)
```

## Responses

### 200

{ success, data: { apiKey (plaintext, shown once), key } }

### 403

OWNER_OR_CREATOR_REQUIRED, or OWNER_ROLE_REQUIRED for a global/write key

### 404

Key not found

### 409

Rotated concurrently; reload

### 500

Internal server error

#### Example

```json
{
  "error": "Internal server error",
  "details": "string",
  "success": false
}
```

- `error` (`post/api/admin/mcp-permissions/keys/keyId/rotate.response.500.error`; string, optional)
  - example `"Internal server error"`
- `details` (`post/api/admin/mcp-permissions/keys/keyId/rotate.response.500.details`; string, optional)
- `success` (`post/api/admin/mcp-permissions/keys/keyId/rotate.response.500.success`; boolean, optional)
  - example `false`


Source: https://developer.channelautomations.com/api/post-api-admin-mcp-permissions-keys-key-id-rotate/index.md