Rotate Key

POST /cdp/keys/rotate — revoke the brand’s active key(s) and mint a replacement. The old key(s) immediately 401; the new plaintext is returned exactly once.

Session credential required

Key management requires a session credential, not an API key. See Authentication.

Request

POST /cdp/keys/rotate
Content-Type: application/json

Body

Field	Type	Required	Description
brand_id	string	staff only	Target brand (staff). A non-staff brand-admin always rotates their own brand.
expires_at	string | number	no	Optional expiry for the new key — ISO-8601 string or epoch milliseconds.

Response 201

The replacement key, in the same shape as issue — including the one-time api_key plaintext:

{
  "id": "key_def",
  "key_prefix": "vyg_EfGh",
  "brand_id": "brand-uuid",
  "is_staff": false,
  "expires_at": null,
  "revoked_at": null,
  "created_at": "2026-01-15T00:00:00.000Z",
  "api_key": "vyg_EfGh…full-plaintext…"
}

After a rotation the brand’s previous active key(s) are revoked and will 401 on any read.

Example

curl -s -X POST "https://cdp.vyg.app/cdp/keys/rotate" \
  -H "Authorization: Bearer <session-credential>" \
  -H "Content-Type: application/json" \
  -d '{}'

Errors

Status	When
400	An invalid expires_at, or brand_id required for a staff operation but omitted.
401	Missing or invalid credential.
403	An API key was used for management; a non-staff caller targeted another brand; or no connected Shopify integration resolves a scope for the brand.
405	Unsupported method.
500	Brand-scope resolution failed.

See Errors for the full envelope.