SupportConsoleDevelopersStart a trialContact

Chapter 5. renewBootstrapToken

Rotate the programmatic bootstrap OAuth token.

5.1. POST /api/v1/bootstrap/renew
Copy link

Renew the bootstrap token and write the new token value to BOOTSTRAP_TOKEN_PATH or the configured Kubernetes Secret. The previous bootstrap token is invalidated immediately. The response does not include the new token value; read it from the configured storage location after renewal.

This endpoint is available only when FEATURE_PROGRAMMATIC_BOOTSTRAP is true.

Authorizations: Bearer token (bootstrap token)

5.2. Request body
Copy link

No request body.

5.3. Responses
Copy link

HTTP CodeDescriptionSchema

200

Successful renewal

{"status": "rotated"}

401

Invalid, missing, or expired bootstrap token

ApiError

403

Unauthorized access

ApiError

Note

When the bootstrap token is expired, renewal is accepted only from localhost. On Kubernetes and OpenShift Container Platform, use port forwarding and ensure the request includes the X-Quay-Bootstrap-Renewal-Location: local header set by the ingress layer.

5.4. Example command
Copy link

$ curl -X POST "https://<quay-server.example.com>/api/v1/bootstrap/renew" \
  -H "Authorization: Bearer <bootstrap_token>"

Example response

{"status": "rotated"}

Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top