Rotate a secret when someone who knew it leaves, or on a schedule. During rotation Sluice signs every request with both the old and the new secret for 24 hours, so your customer can update their server at any point in that window.

curl -X POST https://api.sluicehq.dev/v3/endpoints/ep_Qm81/secret/rotate \
  -H "Authorization: Bearer sk_test_4f9a2c7e1b"

curl -X POST https://api.sluicehq.dev/v3/endpoints/ep_Qm81/secret/rotate \
  -H "Authorization: Bearer sk_test_4f9a2c7e1b"

curl -X POST https://api.sluicehq.dev/v3/endpoints/ep_Qm81/secret/rotate \
  -H "Authorization: Bearer sk_test_4f9a2c7e1b"

While both secrets are active, the header carries two v1 values. The client libraries accept a request if either one matches.

← Verify signatures

IP allowlist →

Something missing or wrong on this page? Tell us at support@sluicehq.dev and we will fix it.