kosli rotate api-key

Synopsis

kosli rotate api-key KEY-ID [KEY-ID...] [flags]

Rotate one or more API keys for a service account, or your own personal API keys. A new API key is generated immediately. The old key remains valid for a grace period to allow time to update dependent systems; that grace period has a standard length unless overridden with --grace-period-hours. The new key value is only returned once, so make sure to store it securely. With --personal and an API key as --api-token, you can rotate only that key and keys created with it, and the rotated key expires no later than that key. To get a key that outlives it, create one from your profile page in the Kosli app.

Flags

Flag	Type	Description
`-D`, `--dry-run`	bool	[optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors.
`-e`, `--expires-at`	string	[optional] When the new API key expires. Accepts an epoch timestamp or a date like ‘2026-06-04’, ‘2026-06-04 15:04:05’, or an RFC3339 timestamp. Defaults to the rotated key’s current expiry, and is capped by the maximum allowed key lifetime.
`-g`, `--grace-period-hours`	int	[optional] How many hours the old API key remains valid after rotation, to allow time to update dependent systems. Defaults to the standard grace period when not set.
`-h`, `--help`	bool	help for api-key
`-o`, `--output`	string	[defaulted] The format of the output. Valid formats are: [table, json]. (default “table”)
`--personal`	bool	Manage your own personal API keys instead of a service account’s. `--org` is not needed. Either this or `--service-account` is required.
`-s`, `--service-account`	string	The name of the service account whose API keys are managed. Either this or `--personal` is required.

Flags inherited from parent commands

Flag	Type	Description
`-a`, `--api-token`	string	The Kosli API token.
`-c`, `--config-file`	string	[optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default “$HOME/.kosli.yml”)
`--debug`	bool	[optional] Print debug logs to stdout.
`-H`, `--host`	string	[defaulted] The Kosli endpoint. (default “https://app.kosli.com”)
`--http-proxy`	string	[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port`
`-r`, `--max-api-retries`	int	[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3)
`--org`	string	The Kosli organization.
`-q`, `--quiet`	bool	[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins.

Examples Use Cases

These examples all assume that the flags --api-token, --org, --host, (and --flow, --trail when required), are set/provided.

rotate an API key for a service account

kosli rotate api-key yourApiKeyID 
	--service-account yourServiceAccountName 

rotate multiple API keys at once

kosli rotate api-key keyID1 keyID2 
	--service-account yourServiceAccountName 

rotate an API key, keeping the old key valid for 48 hours

kosli rotate api-key yourApiKeyID 
	--grace-period-hours 48 
	--service-account yourServiceAccountName 

rotate one of your own personal API keys

kosli rotate api-key yourApiKeyID 
	--personal 

Last modified on October 29, 2026

General

Top-level commands

kosli allow

kosli archive

kosli assert

kosli attest

kosli begin

kosli create

kosli delete

kosli diff

kosli disable / enable

kosli evaluate

kosli get

kosli join

kosli list

kosli log

kosli rename

kosli report

kosli rotate

kosli snapshot

kosli unarchive

kosli update

Synopsis

Flags

Flags inherited from parent commands

Examples Use Cases

​Synopsis

​Flags

​Flags inherited from parent commands

​Examples Use Cases

Synopsis

Flags

Flags inherited from parent commands

Examples Use Cases