Rotate a credential's secrets | Neon Postgres Docs

POST/projects/{project_id}/branches/{branch_id}/credentials/{token_id}/rotateRotate a credential's secrets

Replaces the secret material on an existing scoped credential in place. token_id is preserved — it is the AWS_ACCESS_KEY_ID for S3-compatible clients, so the access key id your application already holds keeps working and only the secret changes. This is the analog of resetting a Postgres password, not of issuing a second credential.

The response carries the new api_token and s3_secret_access_key exactly once. Rotation is not idempotent: retrying after an ambiguous timeout mints another secret and supersedes the previous replacement, so a retry does not recover a lost response — it only invalidates the secret you did not receive. If you lose the response, issue a replacement credential and revoke this one.

The old secret stops authenticating as soon as the rotation commits. Where a region caches credentials on its data-plane verifiers, a replica may briefly keep accepting the old secret — and rejecting the new one — until its cache entry expires; where it does not, the cutover is immediate apart from requests already in flight. Either way the changeover is not atomic across replicas, so retry an unexpected authentication failure right after rotating rather than treating the new secret as bad. last_used_at continues to report the logical credential's prior usage and says nothing about whether the new secret has been used yet.

Only a live, unexpired, unrevoked customer-managed (user) credential on a live project and live branch is eligible. Anything else — including the platform-internal function and system credentials — is reported as not found, indistinguishable from an unknown token_id.

Note: This endpoint is currently in Beta.

Parameters

project_idstringpathrequired

The Neon project ID

pattern ^[a-z0-9-]{1,60}$

branch_idstringpathrequired

The Neon branch ID

pattern ^[a-z0-9-]{1,60}$

token_idstringpathrequired

The opaque credential id (e.g. nak_live_<32hex>).

Responses

objectRotateCredentialResponse

The replacement secret material for an existing credential, returned exactly once. `token_id`, `scopes`, `branch_id` and `created_at` are unchanged by the rotation — only `api_token` and `s3_secret_access_key` are new.

api_tokenstringrequired

The new Bearer token; returned exactly once.

branch_idstringrequired

pattern ^[a-z0-9-]{1,60}$

created_atstring · date-timerequired

When the credential was originally issued. Rotation replaces the secrets in place and does not reset this.

expires_atstring · date-time

When the credential expires; absent means never expires. Rotation does not extend it.

namestring

Customer-supplied label carried on the credential. Absent when none was set at issuance.

principal_typestringrequired

Always `user`: only customer-managed credentials are rotatable through this endpoint.

one of "user"

s3_secret_access_keystringrequired

The new nsk_live_<64 hex> AWS_SECRET_ACCESS_KEY; returned exactly once.

scopesarray of stringrequired

Show child attributes

token_idstringrequired

Opaque credential id (e.g. nak_live_<32hex>), unchanged by the rotation. Doubles as the `AWS_ACCESS_KEY_ID` for SigV4.

token_id_shortstringrequired

First 12 hex chars of token_id; safe to log.

Example response

{
  "api_token": "",
  "branch_id": "string",
  "created_at": "2026-06-09T00:00:00Z",
  "expires_at": "2026-06-09T00:00:00Z",
  "name": "string",
  "principal_type": "user",
  "s3_secret_access_key": "string",
  "scopes": [
    "ai_gateway:invoke"
  ],
  "token_id": "string",
  "token_id_short": "string"
}

defaultGeneral Error. The request may or may not be safe to retry, depending on the HTTP method, response status code, and whether a response was received. - If no response is returned from the API, a network error or timeout likely occurred. - In some cases, the request may have reached the server and been successfully processed, but the response failed to reach the client. As a result, retrying non-idempotent requests can lead to unintended results. The following HTTP methods are considered non-idempotent: `POST`, `PATCH`, `DELETE`, and `PUT`. Retrying these methods is generally **not safe**. The following methods are considered idempotent: `GET`, `HEAD`, and `OPTIONS`. Retrying these methods is **safe** in the event of a network error or timeout. Any request that returns a `503 Service Unavailable` response is always safe to retry. Any request that returns a `423 Locked` response is safe to retry. `423 Locked` indicates that the resource is temporarily locked, for example, due to another operation in progress. application/json

objectGeneralError

codestringrequired

default ""

messagestringrequired

Error message

request_idstring

Unique identifier for the request, useful for debugging. You can set this value manually by including an `X-Request-ID` header in the request. If not provided, the value will be generated automatically.

Example response

{
  "code": "",
  "message": "string",
  "request_id": "string"
}

Examples

project_idrequiredpath parameter

branch_idrequiredpath parameter

token_idrequiredpath parameter

curl -X POST 'https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/rotate'

const response = await fetch('https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/rotate', { method: 'POST' });
const data = await response.json();

const response = await fetch('https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/rotate', { method: 'POST' });
console.log(await response.json());

import requests

response = requests.request("POST", "https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/rotate")
print(response.json())

package main

import (
	"context"
	"net/http"
)

func main() {
	ctx := context.Background()
	req, err := http.NewRequestWithContext(ctx, "POST", "https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/rotate", nil)
	if err != nil {
		panic(err)
	}
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
}

<?php
$request = curl_init("https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/rotate");
curl_setopt($request, CURLOPT_CUSTOMREQUEST, "POST");
$response = curl_exec($request);
curl_close($request);

var request = HttpRequest.newBuilder(URI.create("https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/rotate"))
    .method("POST", HttpRequest.BodyPublishers.noBody())
    .build();
var response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());

require 'net/http'

uri = URI("https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/rotate")
request = Net::HTTPGenericRequest.new("POST", false, true, uri)
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(request) }

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://console.neon.tech/api/v2/projects/string/branches/string/credentials/string/rotate");
using var response = await client.SendAsync(request);

{
  "api_token": "",
  "branch_id": "string",
  "created_at": "2026-06-09T00:00:00Z",
  "expires_at": "2026-06-09T00:00:00Z",
  "name": "string",
  "principal_type": "user",
  "s3_secret_access_key": "string",
  "scopes": [
    "ai_gateway:invoke"
  ],
  "token_id": "string",
  "token_id_short": "string"
}

{
  "code": "",
  "message": "string",
  "request_id": "string"
}