Pre-1.0 · one maintainer · Stripe and cards only · no SDKs (client libraries) yet · no production users yet. Docs describe v0.9.1 (29 Oct 2026) · What’s new →

Rotate the public cost-dashboard token (ADR-032)

POST

/v1/customers/{id}/rotate-cost-dashboard-token

const url = 'http://localhost:8080/v1/customers/example/rotate-cost-dashboard-token';
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url http://localhost:8080/v1/customers/example/rotate-cost-dashboard-token \
  --header 'Authorization: Bearer <token>'

Mints a fresh hc_pcd_… token and writes it to the customer row. The previous token is invalidated immediately (read-only public surface; no grace window). The plaintext token is the sole credential for GET /v1/public/cost-dashboard/{token} and is shown ONCE — Hardcount never returns it again after this response. Audit log records the rotation without the token.

Authorizations

BearerAuth

Parameters

Path Parameters

required

string

Header Parameters

Idempotency-Key

string

Makes the call safe to retry. Send a unique value (a UUID works) and the same value on every retry. For 24 hours, a repeat with the same key, method, path and body gets the first response again, with an Idempotent-Replayed: true header, instead of running again. The error cases are in docs/api-surface.md. The usage routes do not take it: each usage event carries its own idempotency_key.

Responses

200

Rotated

application/json

object

token

required

string

public_url

required

string

Example

{
  "token": "hc_pcd_a3f9c4...",
  "public_url": "https://api.example.com/v1/public/cost-dashboard/hc_pcd_a3f9c4..."
}

404

Customer not found