1 minute readFixedAgent-ready
Rotating an API key asks you to confirm
POST /api/api-keys/rotate now asks for {"confirm": true} before a key replaces itself, so a key someone handed you is never ended by accident.
Rotating a key ends it for everyone who holds it, and only the caller gets the new key. One of our test agents rotated a read-only key it had been given with an empty request, and the owner's copy stopped working.
POST /api/api-keys/rotate now needs {"confirm": true} in the body. Without it the answer is 400 confirmation_required and nothing changes. Sandbox keys from POST /api/agents/register rotate as before. If someone else gave you the key, ask them before rotating it.
For help, write to support@last-price.ai.