---
title: "agents rotate"
description: "Rotate an agent credential's secrets"
canonical: "https://pgbeam.com/docs/cli/agents/rotate"
last-updated: "2026-10-29T19:01:20.000Z"
---

# agents rotate

> Rotate an agent credential's secrets

URL: https://pgbeam.com/docs/cli/agents/rotate

{/* Auto-generated from CLI commands. Do not edit. Run `pnpm generate:cli-docs` to regenerate. */}

Generate a new Postgres password and MCP token for an existing credential, keeping its id, username, name, and policy. Connections using the old password are dropped within seconds. The new secrets are shown once and cannot be retrieved again, so update your agent before its next call. A ready-to-paste MCP client config is printed alongside the secrets. The old secrets cannot be restored, so a confirmation prompt is shown unless `--yes` is passed.

## Usage

```bash
pgbeam agents rotate <id> [flags]
```

## Options

| Option             | Description                                                                                              | Required | Default  |
| ------------------ | -------------------------------------------------------------------------------------------------------- | -------- | -------- |
| `<id>`             | Agent credential ID                                                                                      | Yes      | -        |
| `--client <value>` | MCP client to emit config for: claude (default), claude-desktop, cursor, vscode, cline, windsurf, or all | No       | `claude` |
| `--yes`, `-y`      | Skip the confirmation prompt (useful for scripts and CI/CD)                                              | No       | `false`  |

> **Global options**
>
> All [global options](/docs/cli/global-options) (`--token`, `--profile`,
> `--project`, `--org`, `--json`, `--no-color`, `--no-trunc`, `--debug`) are
> also available on this command.

## Examples

```bash
# Rotate a credential's secrets (with confirmation)
pgbeam agents rotate agt_xxx

# Rotate and emit a VS Code MCP config
pgbeam agents rotate agt_xxx --client vscode

# Rotate without confirmation and capture secrets as JSON (CI/CD)
pgbeam agents rotate agt_xxx --yes --json
```

## Output

Prints the new connection string, MCP URL, MCP token, and a ready-to-paste MCP client config once. With --json, returns the full secrets object.