curl --request POST \
--url https://api.lilt.com/v2/api-keys/{id}/rotate \
--header 'Authorization: Basic <encoded-value>'import requests
url = "https://api.lilt.com/v2/api-keys/{id}/rotate"
headers = {"Authorization": "Basic <encoded-value>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Basic <encoded-value>'}};
fetch('https://api.lilt.com/v2/api-keys/{id}/rotate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.lilt.com/v2/api-keys/{id}/rotate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Basic <encoded-value>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.lilt.com/v2/api-keys/{id}/rotate"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Basic <encoded-value>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.lilt.com/v2/api-keys/{id}/rotate")
.header("Authorization", "Basic <encoded-value>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.lilt.com/v2/api-keys/{id}/rotate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Basic <encoded-value>'
response = http.request(request)
puts response.read_body{
"id": "uuid-1234",
"name": "CI bot",
"prefix": "aaaaaaaa",
"key": "lilt_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"createdAt": "2026-04-29T00:00:00Z",
"expiresAt": "2027-01-01T00:00:00Z",
"ownerEmail": "developer@lilt.com",
"ownerUserId": 42
}{
"error": "No active organization"
}{
"message": "Internal server error."
}Rotate an API key
Replace the prefix and secret of an existing API key, invalidating the previous secret and returning a new plaintext secret. The key’s name and expiry are preserved.
The new secret is shown exactly once. Revoked keys cannot be rotated. The caller must own the key or hold apiKey.write on the current organization. The request body must be empty.
curl --request POST \
--url https://api.lilt.com/v2/api-keys/{id}/rotate \
--header 'Authorization: Basic <encoded-value>'import requests
url = "https://api.lilt.com/v2/api-keys/{id}/rotate"
headers = {"Authorization": "Basic <encoded-value>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Basic <encoded-value>'}};
fetch('https://api.lilt.com/v2/api-keys/{id}/rotate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.lilt.com/v2/api-keys/{id}/rotate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Basic <encoded-value>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.lilt.com/v2/api-keys/{id}/rotate"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Basic <encoded-value>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.lilt.com/v2/api-keys/{id}/rotate")
.header("Authorization", "Basic <encoded-value>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.lilt.com/v2/api-keys/{id}/rotate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Basic <encoded-value>'
response = http.request(request)
puts response.read_body{
"id": "uuid-1234",
"name": "CI bot",
"prefix": "aaaaaaaa",
"key": "lilt_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"createdAt": "2026-04-29T00:00:00Z",
"expiresAt": "2027-01-01T00:00:00Z",
"ownerEmail": "developer@lilt.com",
"ownerUserId": 42
}{
"error": "No active organization"
}{
"message": "Internal server error."
}Authorizations
Basic authentication header of the form Basic <encoded-value>, where <encoded-value> is the base64-encoded string username:password.
Path Parameters
The API key's unique identifier.
Response
The rotated API key with its new plaintext secret (shown once only).
A newly created or rotated API key, including the plaintext secret. The secret is shown exactly once and cannot be retrieved again. Note that lastUsedAt and revokedAt are not returned by the create and rotate operations.
The unique identifier for the API key.
"uuid-1234"
A human-readable label for the key.
"CI bot"
The first 8 characters of the key's random portion — the part that follows the lilt_ prefix. Safe to display.
"aaaaaaaa"
The full plaintext API key (lilt_ followed by 40 hex characters). Shown once only.
"lilt_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
ISO-8601 timestamp when the key was created.
"2026-04-29T00:00:00Z"
ISO-8601 timestamp when the key expires, or null if it does not expire.
"2027-01-01T00:00:00Z"
Email address of the user who owns the key. Returned when creating a key; omitted when rotating one.
"developer@lilt.com"
Numeric identifier of the user who owns the key. Returned when creating a key; omitted when rotating one.
42
Was this page helpful?

