Rotate an API key secret

Rotate the secret of an API key: a fresh prefix + secret is returned in plaintext exactly once.

Irreversible. - The previous secret keeps working for a 24-hour grace window; rotating again in that window replaces it at once. - A key with scopes the calling key does not cover returns 403 insufficient_scope and nothing is rotated.

Authorization

AuthorizationBearer <token>

Your API key as a bearer token: fact_live_… in production, fact_test_… in sandbox. See the authentication guide.

In: header

Path Parameters

account*string

Public identifier (UUID v7) of your account. Get it from GET /v1/me (data.account.id).

Formatuuid

api_key*string

Public identifier (UUID v7) of the API key.

Formatuuid

Headers

Idempotency-Key*string

Client-generated opaque key (up to 255 characters; UUID v7 recommended) that makes retries safe: the first response is cached and replayed for repeats without re-executing the mutation. Reusing a key with a different body returns 422 idempotency_key_reused; the values of secret fields (password, secret…) count as part of the body, so retrying with a corrected secret under the same key is a different request, never the replay of the earlier answer. See the Idempotency guide. Required on this operation: repeating it delivers an effect that cannot be taken back (an email sent, a file generated, a third-party call, a charge), so a request without this header is rejected with 422 idempotency_key_required before any business logic runs.

Length1 <= length <= 255

Factuarea-Version?string

Pin the API version (YYYY-MM-DD, Stripe-style date versioning) for this request; omit to use the key's pinned version, or the latest if none. Unsupported version → 400 unsupported_api_version; malformed → 400 parameter_invalid_format. The effective version is echoed in the Factuarea-Version response header. See the Versioning guide.

Formatdate

Response Body

`application/json`

Request example

const apiKey = process.env.FACTUAREA_API_KEY;if (!apiKey) throw new Error("Set FACTUAREA_API_KEY");const response = await fetch("https://api.factuarea.com/v1/accounts/01931b3e-7c4a-7f2e-9a8b-3c5d6e7f8a01/api-keys/01931b3e-7c4a-7f2e-9a8b-3c5d6e7f8a01/rotate-secret", {  method: "POST",  headers: { Authorization: `Bearer ${apiKey}`, ...{"Accept":"application/json","Idempotency-Key":"erp-2026-public-api-v1-account-api_keys-rotate_secret"} },});if (!response.ok) throw new Error(await response.text());if (response.status !== 204) console.log(await response.json());

Response example

{
  "data": {
    "id": "01931b3e-7c4a-7f2e-9a8b-4d6e7f8a9b0c",
    "object": "api_key",
    "name": "Producción",
    "prefix": "fact_live_1OSf9KdP",
    "scopes": [
      "account:read",
      "invoices:read",
      "invoices:write"
    ],
    "tier": "scale",
    "environment": "live",
    "created_at": "2026-01-15T09:30:00Z",
    "last_used_at": "2026-05-25T18:00:00Z",
    "expires_at": null,
    "revoked_at": null,
    "is_active": true,
    "is_revoked": false,
    "ip_allowlist": [
      "203.0.113.10",
      "198.51.100.0/24"
    ],
    "allowed_origins": null,
    "last_used_ip": "203.0.113.10",
    "nif_scope": [
      {
        "id": "0193f1a0-5c2e-7b41-8d06-9a1e2f3c4d5e",
        "tax_id": "B12345674",
        "name": "Distribuciones Ejemplo SL",
        "access_level": "operate"
      },
      {
        "id": "01931b3e-7c4a-7f2e-9a8b-3c5d6e7f8a01",
        "tax_id": "B87654323",
        "name": "Talleres García SL",
        "access_level": "view"
      }
    ],
    "created_by": {
      "id": "01933a50-2c41-7a8b-9c0d-1e2f3a4b5c01",
      "name": "Marta Ibáñez"
    },
    "revoked_by": null,
    "revoke_reason": null,
    "secret_rotated_at": "2026-10-10T08:00:00Z",
    "secret_rotated_by": {
      "id": "01933a50-2c41-7a8b-9c0d-1e2f3a4b5c01",
      "name": "Marta Ibáñez"
    },
    "previous_secret_valid_until": "2026-10-11T08:00:00Z",
    "secret": "fact_live_1OSf9KdPq8r2s4t6u8w0y2A4c6E8g0I2"
  }
}

Retired X-Active-Profile header sent

{
  "error": {
    "type": "invalid_request_error",
    "code": "parameter_unknown",
    "subcode": "retired_active_profile_header",
    "message": "La cabecera 'X-Active-Profile' fue retirada de la API v1: la empresa efectiva se indica en el segmento de empresa de la ruta.",
    "param": "X-Active-Profile",
    "doc_url": "https://docs.factuarea.com/guides/errors#parameter_unknown",
    "request_id": "req_01J8Y3M2Q40000000000000001"
  }
}

Malformed Factuarea-Version header

{
  "error": {
    "type": "invalid_request_error",
    "code": "parameter_invalid_format",
    "message": "El header 'Factuarea-Version' debe tener formato YYYY-MM-DD.",
    "param": "Factuarea-Version",
    "doc_url": "https://docs.factuarea.com/guides/errors#parameter_invalid_format",
    "request_id": "req_01J8Y3M2Q40000000000000002"
  }
}

Unsupported Factuarea-Version

{
  "error": {
    "type": "invalid_request_error",
    "code": "unsupported_api_version",
    "message": "La versión de API '2020-01-01' no está soportada.",
    "param": "Factuarea-Version",
    "doc_url": "https://docs.factuarea.com/guides/errors#unsupported_api_version",
    "request_id": "req_01J8Y3M2Q40000000000000003"
  }
}

{
  "error": {
    "type": "authentication_error",
    "code": "missing_api_key",
    "message": "Falta header Authorization o X-API-Key.",
    "doc_url": "https://docs.factuarea.com/guides/errors#missing_api_key",
    "request_id": "req_63d6930c12ba46fcd5f353bf75"
  }
}

{
  "error": {
    "type": "authorization_error",
    "code": "insufficient_scope",
    "message": "Esta operación requiere el scope 'account:write'. Tu API key solo tiene los scopes: ninguno.",
    "doc_url": "https://docs.factuarea.com/guides/errors#insufficient_scope",
    "request_id": "req_d458596800c98591824e4de7fb"
  }
}

POST /v1/accounts/{account}/api-keys/{api_key}/rotate-secret · 404 resource_not_found

{
  "error": {
    "type": "not_found_error",
    "code": "resource_not_found",
    "message": "El recurso solicitado no existe.",
    "doc_url": "https://docs.factuarea.com/guides/errors#resource_not_found",
    "request_id": "req_044468ca13f762397df35e1d2c"
  }
}

Account not found or not the account of the API key

{
  "error": {
    "type": "not_found_error",
    "code": "account_not_found",
    "message": "La cuenta indicada no existe o no es la de tu credencial.",
    "param": "account",
    "doc_url": "https://docs.factuarea.com/guides/errors#account_not_found",
    "request_id": "req_01J8Y3M2Q40000000000000006"
  }
}

POST /v1/accounts/{account}/api-keys/{api_key}/rotate-secret · 422 invalid_param_format

{
  "error": {
    "type": "invalid_request_error",
    "code": "invalid_param_format",
    "message": "La Idempotency-Key debe tener entre 1 y 255 caracteres ASCII printable.",
    "param": "Idempotency-Key",
    "doc_url": "https://docs.factuarea.com/guides/errors#invalid_param_format",
    "request_id": "req_43d95b5c291bd54ddc4d7dbbef"
  }
}

Idempotency key reused with a different payload

{
  "error": {
    "type": "idempotency_error",
    "code": "idempotency_key_reused",
    "message": "La Idempotency-Key 'order-2026-0001' ya se usó con un payload distinto.",
    "param": "Idempotency-Key",
    "doc_url": "https://docs.factuarea.com/guides/errors#idempotency_key_reused",
    "request_id": "req_01J8Y3M2Q40000000000000007"
  }
}

Idempotency-Key missing on an external-effect write

{
  "error": {
    "type": "invalid_request_error",
    "code": "idempotency_key_required",
    "message": "La operación «public-api.v1.invoices.send» exige la cabecera Idempotency-Key desde el 2026-10-01. Envía una clave única por operación (un UUID sirve) y, si reintenta, repite exactamente la misma clave para que la operación no se ejecute dos veces.",
    "param": "Idempotency-Key",
    "doc_url": "https://docs.factuarea.com/guides/errors#idempotency_key_required",
    "request_id": "req_01J8Y3M2Q40000000000000009"
  }
}

{
  "error": {
    "type": "rate_limit_error",
    "code": "rate_limit_exceeded",
    "message": "Has excedido el límite de requests permitido. Reintenta más tarde.",
    "doc_url": "https://docs.factuarea.com/guides/errors#rate_limit_exceeded",
    "request_id": "req_a8f40bb489144654887b1381fa"
  }
}

{
  "error": {
    "type": "api_error",
    "code": "internal_error",
    "message": "Algo se rompió en nuestro lado al procesar la petición. La condición no la provoca tu payload.",
    "doc_url": "https://docs.factuarea.com/guides/errors#internal_error",
    "request_id": "req_c2a968403a20c556e2843bfc39"
  }
}

Rotate an API key secret

Authorization

Path Parameters

Headers

Response Body

200application/json

400application/json

401application/json

403application/json

404application/json

422application/json

429application/json

500application/json

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`