Development · Rotate keys
Rotate keys
Replace a live key with a fresh one — no login, no re-payment. The key you send is the proof of ownership, so rotation is a single authenticated request against the key you already hold.
POST /api/v1/keys/rotate
Send your current key as Authorization: Bearer <key>. There is no request body. On success the old key is revoked and the replacement is returned.
curl -X POST "https://www.finddoc.ca/api/v1/keys/rotate" \
-H "Authorization: Bearer YOUR_API_KEY"{
"key": "fd_live_9c2f…",
"key_prefix": "fd_live_9c2f"
}Swap to the new key immediately
- The old key dies at once. There is no grace period and no overlap window — the moment the response comes back, requests using the previous key return
401. Rotate when you can deploy the new value, not mid-traffic. - The new key is returned exactly once. We store only a hash, so we cannot show it again. Write it to your secret store before you close the terminal — if you lose it, the only way out is to rotate again with the key you just lost.
- Rotation is free and unlimited. It does not create a second key or a second charge — your one paid key is replaced in place, keeping the same tier.
Keys that can't be rotated here
This endpoint serves paid developer keys only. The published sandbox key and the RapidAPI key are shared across every caller, and admin keys are session-managed in the API keys dashboard. All three are refused with 403.
{
"error": "not_rotatable",
"message": "Only a paid developer key can be rotated here. Admin keys are managed in the dashboard; the sandbox and RapidAPI keys are shared."
}Lost your key entirely?
Then rotation can't help you — it authenticates with the very key you no longer have. Being keyless means there is no account to sign into and no email on file to recover through, so we have no honest way to prove the key was yours. The only route back is a new checkout, which is a new CAD $5 payment and issues an unrelated key. Get API access →
Email-based recovery is not built yet. Until it is, treat your key like a password you can reset only while you still know it.