Skip to main content
POST
Replace the secret, keeping the old one until it retires

Authorizations

Authorization
string
header
required

Short-lived random access credential backed by current server-side session state.

Headers

If-Match
string
required

Strong numeric entity tag returned by the preceding representation.

Pattern: ^"[0-9]+"$

Response

New secret disclosed once. The superseded secret keeps working for 24 hours.

The one and only disclosure of a secret. What is stored is a peppered digest, so this value cannot be produced again and a lost secret is rotated rather than looked up.

merchantId
string<uuid>
required
clientId
string
required
Maximum string length: 64
clientSecret
string
required
Maximum string length: 128
version
integer<int64>
required
Required range: x >= 0