---
title: "Rotate the edit secret"
description: "Replaces a document's edit secret, for when the old one leaked."
canonical_url: https://docs.markdrop.in/api/documents/rotate-the-edit-secret
last_updated: 2026-10-30
site: "Markdrop Docs"
index: https://docs.markdrop.in/llms.txt
---

# Rotate the edit secret

`POST https://api.markdrop.in/api/v1/documents/{slug}/edit-secret/rotate`

Replaces a document's edit secret, for when the old one leaked. The old secret stops working at once; the new one is in the response, once. Owner only.

- **Authentication:** API token required: `Authorization: Bearer mdk_…`.
- **Rate limit:** 10 per minute per IP address.
- **Guide:** [If the secret leaks](https://docs.markdrop.in/documents/edit-key#if-the-secret-leaks)

## Path parameters

- `slug` (string, required): The document's address: the part after `markdrop.in/`.

## Responses

- `200`: OK.
- `401`: No token, or the token is revoked or mistyped.
- `422`: The request didn't validate. `detail` lists each problem, with where it is (`loc`) and why (`msg`).
- `429`: Too many requests from your IP address. Wait the seconds in `Retry-After`.

## Examples

**curl**

```bash
curl -X POST https://api.markdrop.in/api/v1/documents/k3x9q2m/edit-secret/rotate \
  -H "Authorization: Bearer $MARKDROP_TOKEN"
```

**JavaScript**

```javascript
const res = await fetch("https://api.markdrop.in/api/v1/documents/k3x9q2m/edit-secret/rotate", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.MARKDROP_TOKEN}`,
  },
});
const data = await res.json();
```

**Python**

```python
import os

import requests

r = requests.post(
    "https://api.markdrop.in/api/v1/documents/k3x9q2m/edit-secret/rotate",
    headers={"Authorization": f"Bearer {os.environ['MARKDROP_TOKEN']}"},
)
r.raise_for_status()
print(r.json())
```