> ## Documentation Index > Fetch the complete documentation index at: https://docs.keystoneos.xyz/llms.txt > Use this file to discover all available pages before exploring further. # Rotate environment client secret > Requires the `platform:security:manage` scope (as an M2M scope or a user permission). Rotate the Auth0 M2M client secret for the caller's own environment. The new client_secret is returned exactly once in this response - Keystone never stores it and it cannot be retrieved again, only rotated again. Per Auth0's documented rotation behavior, new secrets may be delayed up to thirty seconds while rotating; during this propagation window either the old or the new secret may be accepted, after which the old secret is no longer valid. Deploy the new secret promptly and expect tokens already issued to remain valid until they expire. ## OpenAPI ````yaml /api-reference/openapi.json post /v1/platforms/me/environments/{environment_id}/rotate-secret openapi: 3.1.0 info: title: Keystone API description: Settlement orchestration API for tokenized Real-World Assets (RWAs). version: 0.9.0 x-keystone-api-contract-version: 0.9.0 x-keystone-source-revision: c094c5ec38de81d550cde98e6366efaac99cffea servers: - url: https://api-staging.keystoneos.xyz description: Staging (sandbox) - url: https://api.keystoneos.xyz description: Production security: - bearerAuth: [] tags: - name: health description: Health and version checks. - name: platforms description: Register and manage your platform profile. - name: environments description: Manage platform environments (sandbox, production). - name: settlement-templates description: View and manage settlement templates. - name: settlements description: Initiate, monitor, and manage settlements. - name: sessions description: Create and manage browser-safe session tokens for frontend widgets. - name: instructions description: Submit and manage settlement instructions. - name: invitations description: Invite team members to your platform. - name: members description: Manage platform team members and roles. - name: webhooks description: Configure webhook endpoints for real-time event notifications. - name: security description: IP allowlisting and API access controls. - name: activity description: Audit trail of platform actions. - name: dashboard description: Dashboard metrics and statistics. - name: callbacks description: Provider callback handlers (internal). - name: alchemy-webhooks description: Alchemy blockchain event webhooks (internal). - name: chains description: Supported blockchain networks for settlement. - name: admin description: KeyStone internal administration endpoints. - name: admin-platforms description: Admin platform management. - name: admin-settlements description: Admin settlement oversight and intervention. - name: admin-compliance description: Admin compliance check management. - name: admin-activity description: Admin system-wide activity logs. - name: admin-webhooks description: Admin webhook diagnostics. - name: internal description: Keystone-internal worker endpoints. - name: internal-compliance description: Internal compliance engine endpoints. paths: /v1/platforms/me/environments/{environment_id}/rotate-secret: post: tags: - environments summary: Rotate environment client secret description: >- Requires the `platform:security:manage` scope (as an M2M scope or a user permission). Rotate the Auth0 M2M client secret for the caller's own environment. The new client_secret is returned exactly once in this response - Keystone never stores it and it cannot be retrieved again, only rotated again. Per Auth0's documented rotation behavior, new secrets may be delayed up to thirty seconds while rotating; during this propagation window either the old or the new secret may be accepted, after which the old secret is no longer valid. Deploy the new secret promptly and expect tokens already issued to remain valid until they expire. operationId: >- rotate_environment_secret_v1_platforms_me_environments__environment_id__rotate_secret_post parameters: - name: environment_id in: path required: true schema: type: string format: uuid title: Environment Id responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/RotatedSecretRead' '404': description: Environment not found. '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' '429': description: >- Too many credentials issued on this route: RATE_LIMIT_CREDENTIAL_ISSUANCE. Retry-After reports when the window frees a slot. headers: Retry-After: schema: type: string X-RateLimit-Limit: schema: type: string X-RateLimit-Remaining: schema: type: string X-RateLimit-Reset: schema: type: string '502': description: Failed to rotate the client secret in Auth0. '503': description: Auth0 Management API not configured. components: schemas: RotatedSecretRead: properties: client_id: type: string title: Client Id client_secret: type: string title: Client Secret x-keystone-credential: true rotated_at: type: string format: date-time title: Rotated At type: object required: - client_id - client_secret - rotated_at title: RotatedSecretRead description: |- Result of rotating an environment's M2M client secret. The client_secret is revealed exactly once in this response. It is never stored by Keystone and cannot be retrieved again - only rotated again. HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail code: type: string enum: - VALIDATION_ERROR title: Code docs_url: type: string title: Docs Url examples: - https://docs.keystoneos.xyz/guides/error-codes#validation-error type: object title: HTTPValidationError required: - detail - code - docs_url ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type type: object required: - loc - msg - type title: ValidationError securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Auth0 JWT access token. See [Authentication](/getting-started/authentication) for details. ````