> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stella-commerce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate Storefront Token

> Rotate a token: mint a fresh one carrying the old name/scopes/
allowed_origins, then revoke the old. The new plaintext `secret`
is returned exactly once.



## OpenAPI

````yaml /api-reference/openapi.json post /api/dashboard/storefront-tokens/{key_id}/rotate
openapi: 3.1.0
info:
  title: Agentic Commerce API
  description: |2-

        Agentic Commerce API - E-commerce Backend

        ## APIs

        ### Dashboard API (`/api/dashboard`)
        Authenticated endpoints for merchant management:
        - Products, Variants, Options
        - Inventory management
        - Orders and fulfillment
        - Customers
        - Collections

        ### Storefront API (`/api/storefront`)
        Public endpoints for client websites:
        - Product catalog
        - Collections
        - Cart management
        - Checkout

        ### Sync API (`/api/sync`)
        Integration endpoints for zunkiree-search:
        - Product sync
        - Availability checks
        - Order creation from AI widget
        
  version: 1.0.0
servers: []
security: []
paths:
  /api/dashboard/storefront-tokens/{key_id}/rotate:
    post:
      tags:
        - Dashboard
        - Storefront Tokens
      summary: Rotate Storefront Token
      description: |-
        Rotate a token: mint a fresh one carrying the old name/scopes/
        allowed_origins, then revoke the old. The new plaintext `secret`
        is returned exactly once.
      operationId: >-
        rotate_storefront_token_api_dashboard_storefront_tokens__key_id__rotate_post
      parameters:
        - name: key_id
          in: path
          required: true
          schema:
            type: string
            title: Key Id
        - name: authorization
          in: header
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Authorization
        - name: X-API-Key
          in: header
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: X-Api-Key
        - name: X-Stella-Merchant-Id
          in: header
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: X-Stella-Merchant-Id
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorefrontTokenRotatedResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    StorefrontTokenRotatedResponse:
      properties:
        id:
          type: string
          format: uuid
          title: Id
        key_id:
          type: string
          title: Key Id
        secret_prefix:
          type: string
          title: Secret Prefix
        name:
          anyOf:
            - type: string
            - type: 'null'
          title: Name
        scopes:
          items:
            type: string
          type: array
          title: Scopes
        allowed_origins:
          items:
            type: string
          type: array
          title: Allowed Origins
        created_at:
          type: string
          format: date-time
          title: Created At
        last_used_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Last Used At
        revoked_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Revoked At
        secret:
          type: string
          title: Secret
          description: >-
            The plaintext storefront secret (`stk_sec_<...>`). Returned only at
            creation time; not recoverable later.
        rotated_from_key_id:
          type: string
          title: Rotated From Key Id
          description: The key_id of the token that was just revoked.
      type: object
      required:
        - id
        - key_id
        - secret_prefix
        - name
        - scopes
        - allowed_origins
        - created_at
        - last_used_at
        - revoked_at
        - secret
        - rotated_from_key_id
      title: StorefrontTokenRotatedResponse
      description: |-
        Response from `POST /storefront-tokens/{key_id}/rotate`. Carries
        both the new token's metadata + plaintext secret AND the previous
        `key_id` that was revoked, so the dashboard can confirm the swap.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError

````