> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kosli.com/llms.txt
> Use this file to discover all available pages before exploring further.

# kosli rotate api-key

> Rotate one or more API keys for a service account.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli rotate api-key KEY-ID [KEY-ID...] [flags]
```

Rotate one or more API keys for a service account.

A new API key is generated immediately. The old key remains valid for a grace period to
allow time to update dependent systems; that grace period has a standard length unless
overridden with `--grace-period-hours`. The new key value is only returned once, so make
sure to store it securely.

## Flags

| Flag | Type | Description |
| :- | :- | :- |
| `-D`, `--dry-run` | bool | \[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. |
| `-e`, `--expires-at` | string | \[optional] When the new API key expires. Accepts an epoch timestamp or a date like '2026-06-04', '2026-06-04 15:04:05', or an RFC3339 timestamp. Defaults to the rotated key's current expiry, and is capped by the maximum allowed key lifetime. |
| `-g`, `--grace-period-hours` | int | \[optional] How many hours the old API key remains valid after rotation, to allow time to update dependent systems. Defaults to the standard grace period when not set. |
| `-h`, `--help` | bool | help for api-key |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |
| `-s`, `--service-account` | string | The name of the service account whose API keys are managed. |

## Flags inherited from parent commands

| Flag | Type | Description |
| :- | :- | :- |
| `-a`, `--api-token` | string | The Kosli API token. |
| `-c`, `--config-file` | string | \[optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "\$HOME/.kosli.yml") |
| `--debug` | bool | \[optional] Print debug logs to stdout. |
| `-H`, `--host` | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)") |
| `--http-proxy` | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` |
| `-r`, `--max-api-retries` | int | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3) |
| `--org` | string | The Kosli organization. |
| `-q`, `--quiet` | bool | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](/getting_started/install/#assigning-flags-via-environment-variables).

<AccordionGroup>
  <Accordion title="rotate an API key for a service account">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli rotate api-key yourApiKeyID 
    	--service-account yourServiceAccountName 

    ```
  </Accordion>

  <Accordion title="rotate multiple API keys at once">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli rotate api-key keyID1 keyID2 
    	--service-account yourServiceAccountName 

    ```
  </Accordion>

  <Accordion title="rotate an API key, keeping the old key valid for 48 hours">
    ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
    kosli rotate api-key yourApiKeyID 
    	--grace-period-hours 48 
    	--service-account yourServiceAccountName 
    ```
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.