Skip to main content
POST
Rotate Storefront Token

Headers

authorization
string | null
X-API-Key
string | null
X-Stella-Merchant-Id
string | null

Path Parameters

key_id
string
required

Response

Successful Response

Response from POST /storefront-tokens/{key_id}/rotate. Carries both the new token's metadata + plaintext secret AND the previous key_id that was revoked, so the dashboard can confirm the swap.

id
string<uuid>
required
key_id
string
required
secret_prefix
string
required
name
string | null
required
scopes
string[]
required
allowed_origins
string[]
required
created_at
string<date-time>
required
last_used_at
string<date-time> | null
required
revoked_at
string<date-time> | null
required
secret
string
required

The plaintext storefront secret (stk_sec_<...>). Returned only at creation time; not recoverable later.

rotated_from_key_id
string
required

The key_id of the token that was just revoked.