Rotate API keys

Atomically replaces existing credentials. Returns a new token + secret. Rotation grace period (confirmed behavior): the outgoing pair stays valid for a bounded window (15 minutes by default, operator-configurable via `MERCHANT_KEY_GRACE_PERIOD`, `0` disables). The grace is strictly pair-scoped — only the COMPLETE old pair (old token + old secret) is accepted during the window; mixed combinations return 401. Outgoing webhooks are signed with the NEW secret immediately.

POST/api/v1/p2p/merchant/api-keys/rotate

Atomically replaces existing credentials. Returns a new token + secret. Rotation grace period (confirmed behavior): the outgoing pair stays valid for a bounded window (15 minutes by default, operator-configurable via MERCHANT_KEY_GRACE_PERIOD, 0 disables). The grace is strictly pair-scoped — only the COMPLETE old pair (old token + old secret) is accepted during the window; mixed combinations return 401. Outgoing webhooks are signed with the NEW secret immediately.

Authorization

MerchantToken MerchantSignature

X-Merchant-Token<token>

64-character hex public merchant token assigned during onboarding.

In: header

X-Signature<token>

Stripe-style HMAC-SHA256 signature. Format: t=<unix_seconds>,v1=<hex_hmac_sha256> where hex_hmac = HMAC-SHA256(webhook_secret, "<unix_seconds>.<raw_body>"). Replay window: 5 minutes (60s future drift tolerated).

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

tenant_id?string

Formatuuid

merchant_id?string

Formatuuid

Response Body

`application/json`

`application/problem+json`

curl -X POST "https://example.com/api/v1/p2p/merchant/api-keys/rotate" \  -H "Content-Type: application/json" \  -d '{}'

{  "token": "string",  "secret": "string"}

{  "type": "../dictionary",  "title": "string",  "status": 0,  "detail": "string",  "instance": "../dictionary",  "errors": [    {      "field": "amount",      "message": "must be greater than 0",      "code": "POSITIVE_REQUIRED"    }  ]}