# rotate-inference-key

Free; owner only; destructive (delayed two-step wallet confirmation).

Inputs: `keyId` and `currentKeyPrefix`: the `keyPrefix` that `get-inference-key` shows, which is always the key's latest secret (after a revocation or owner change, the stopped secret's prefix). An older prefix is refused.

The current secret stops working at NEAR, and any earlier secret still being stopped is confirmed stopped; then a new secret is issued under the same `keyId` with the remaining balance as its limit. Credit and balance are kept. A confirmation for a secret that is no longer current is refused. A key with no credit left gets no new secret (`refusal.code` `no_credit`); the old secret stays stopped. Top up with `top-up-inference-account`, then rotate again with the same prefix.

Next step: retrieve the new secret with `get-inference-key`.