> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate keys

> Replace a key's key material without changing your applications.

When you rotate a key, Infisical creates new key material for it and increases the key's version by one. The key keeps its ID and name, so your applications keep working without any changes:

* Infisical encrypts new data with the new key material
* Infisical keeps every earlier version of the key material, and decrypts each ciphertext with the version that encrypted it
* Infisical doesn't re-encrypt data you encrypted before the rotation. To move that data to the new key material, decrypt the data and encrypt it again

You can rotate only Encrypt/Decrypt keys. To replace a Sign/Verify or Generate/Verify MAC key, create a new key and update your applications to use it.

> [!WARNING]
>
> Only Infisical has the earlier versions of the key material. If a system keeps its own copy of the key material, it gets only the new version after the rotation, and can't decrypt data it encrypted with an earlier version:
>
> * **KMIP clients**: Don't rotate a key that a [KMIP client](https://infisical.com/docs/documentation/platform/kms/kmip.md) uses. Create a new key for the client instead
> * **Exported keys**: An export contains only the current version. If you keep exported key material as a backup, [export the key](https://infisical.com/docs/documentation/platform/kms/export-import.md) again after each rotation, and keep every export

## Prerequisites

* An [Encrypt/Decrypt key](https://infisical.com/docs/documentation/platform/kms/keys.md#create-a-key) that isn't disabled
* The **Admin** or **Member** role in the key's project

## Rotate a key

**Infisical UI**

**Step 1**

In your KMS project, go to **Overview**, select the options menu on the key's row, then select **Rotate Key**.

**Step 2**

Type `confirm`, then select **Rotate**.

The key's **Version** column shows the new version.

**API**

Call [the rotate key endpoint](https://infisical.com/docs/api-reference/endpoints/kms/keys/rotate.md) with the key's ID:

```bash theme={"dark"}
curl --request POST \
  --url https://app.infisical.com/api/v1/kms/keys/<key-id>/rotate \
  --header 'Authorization: Bearer <access-token>'
```

> [!NOTE]
>
> If you use EU Cloud or self-host Infisical, replace `https://app.infisical.com` with `https://eu.infisical.com` or the address of your instance.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.