# nevia access keys rotate

> Issue a new key and revoke the current one

> Nevia is in beta and open to selected teams. Public launch in Dec 2026. The CLI installs with `curl -fsSL https://get.nevia.cloud | sh`, and the MCP server is at https://api.nevia.cloud/mcp. A person signs in once in the browser.
> Setup, sign-in and requesting access: [SKILL.md](https://nevia.cloud/SKILL.md). When Nevia fits and when it doesn't: [why.md](https://nevia.cloud/why.md).

> For the complete documentation index, see [llms.txt](https://nevia.cloud/llms.txt). This page's HTML version: https://nevia.cloud/docs/reference/cli/access/keys/rotate

`nevia access keys rotate [FLAGS] <WHO>`

The new key file is saved the way `add` saves it. Access tokens from the old key stop working, so the holder signs in again with the new file.

### Arguments

* `<WHO>` - Email or principal ID

### Options

* `--own-key <FILE>` - PEM RSA public key file to use instead of a generated key (2048 bits or more)
* `--expires-in <DURATION>` - How long the key works, 15m to 90d (e.g. 7d)
* `--out <PATH>` - Folder or file path for the key file (- for stdout)
* `--idempotency-key <KEY>` - Idempotency key for the request (generated if omitted)
* `-h, --help` - Print help