Skip to content
Docs

Rotate Installation Credential

POSThttps://api.vercel.com/v1/installations/{integrationConfigurationId}/credentials/rotate
Issues a replacement access token for an installation, so a partner can rotate a credential it believes is compromised without the customer having to reinstall. Authenticated by the credential being replaced plus the integration's client secret: a leaked access token on its own cannot rotate itself, which would otherwise let an attacker take over the installation and lock the partner out. The previous credential intentionally stays valid so in-flight requests keep working. Retiring it is a separate, explicit operation — a partner is never left mid-rotation without a working credential.
Request
import { Vercel } from "@vercel/sdk";


const vercel = new Vercel({
  bearerToken: "<YOUR_BEARER_TOKEN_HERE>",
});


async function run() {
  const result = await vercel.marketplace.rotateInstallationCredential({
    integrationConfigurationId: "<id>",
  });


  console.log(result);
}


run();
Response
{
  "access_token": "string",
  "expires_in": "123",
  "scope": "string",
  "token_type": "oauth2-token"
}

Authentication

AuthorizationbearerToken

Default authentication mechanism

Path parameters

integrationConfigurationIdstringRequired

Body

application/json
client_secretstringRequired
client_idstringOptional

Response

200Success
access_tokenstringRequired
expires_innumberRequired
scopestringRequired
token_typestringRequired

Errors

400One of the provided values in the request body is invalid. One of the provided values in the request query is invalid.
401The request is not authorized.
403You do not have permission to access this resource.
404Error
409Error
410Error