curl -X POST https://api.liddie.io/api/v1/api-keys/publishable/rotate \
-H "Authorization: Bearer <dashboard JWT>"
// Dashboard-session endpoint: send the JWT as a Bearer token.
const response = await fetch('https://api.liddie.io/api/v1/api-keys/publishable/rotate', {
method: 'POST',
headers: { 'Authorization': 'Bearer <dashboard JWT>' },
});
const { publishableKey } = await response.json();
{
"publishableKey": "<string>"
}API keys
Rotate publishable key
Rotate your Liddie publishable key (pk_live_*) — the old value stops authorizing widget payments immediately, so update embedded widgets.
POST
/
api
/
v1
/
api-keys
/
publishable
/
rotate
curl -X POST https://api.liddie.io/api/v1/api-keys/publishable/rotate \
-H "Authorization: Bearer <dashboard JWT>"
// Dashboard-session endpoint: send the JWT as a Bearer token.
const response = await fetch('https://api.liddie.io/api/v1/api-keys/publishable/rotate', {
method: 'POST',
headers: { 'Authorization': 'Bearer <dashboard JWT>' },
});
const { publishableKey } = await response.json();
{
"publishableKey": "<string>"
}Mint a new
No MFA is needed — the publishable key grants no read or withdraw capability. It can only create widget payments, gated by each widget’s origin allowlist and rate limits.
pk_live_* publishable key for your embeddable Payment/Donation widgets.
This endpoint takes no parameters — the key is rotated for the merchant in your session.
The old
pk_live_* value stops working the moment this call returns. Rotate only when you’re ready to update every embedded widget right away.Authorization
This endpoint is dashboard-only: a dashboard JWT with rolemerchant_admin, merchant_member (with team permission widgets:manage) or super_admin. API-key callers are rejected with 401 {"error":"Invalid or expired token"} — the JWT guard runs first and an API key is not a session token, so the call never reaches the role check. The key is not revoked; it simply cannot authenticate a dashboard-only route. Rate limit: 3/min.
A
super_admin passes the role guard, but platform accounts carry no merchant context, so the handler
short-circuits with 400 {"ok":false,"error":{"code":"NO_MERCHANT_CONTEXT","message":"No merchant context"}}.
In practice this endpoint is for merchant accounts.curl -X POST https://api.liddie.io/api/v1/api-keys/publishable/rotate \
-H "Authorization: Bearer <dashboard JWT>"
// Dashboard-session endpoint: send the JWT as a Bearer token.
const response = await fetch('https://api.liddie.io/api/v1/api-keys/publishable/rotate', {
method: 'POST',
headers: { 'Authorization': 'Bearer <dashboard JWT>' },
});
const { publishableKey } = await response.json();
Response fields
string
The new
pk_live_* value (see Get publishable key — it is not secret).See also
- Get publishable key: read the current
pk_live_*value at any time. - Revoke an API key: the equivalent kill-switch for secret (
lid_live_*) keys. - Authentication: how publishable, secret, and dashboard credentials differ.