---
title: "Rotate the Amp provider token"
description: "Replace the Amp provider token without losing orb state."
---

> Documentation Index
> Fetch the complete documentation index at: https://cf-orbs-site.mdick85.workers.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate the Amp provider token

Orb state lives in the Worker, so a token swap loses none. Jobs that arrive while the provider restarts wait in Amp, which offers unclaimed jobs again.

1. **Make a new token**

   In Amp, go to Settings → Orbs → your provider and create a new token. Keep the old one for now.
2. **Put the new token in place**

   In Cloudflare provider mode, write the new token to a file with mode 600, then run:

   ```sh
   npx cf-orbs init --token-file <file>
   ```

   `init` sets the Worker secret and asks the Worker to start the provider. The Worker sees a different token hash, so it stops the old container and starts a new one. If that doesn't happen, the next cron or alarm (5 min at most) does the swap.

   In external mode, edit `/etc/cf-orbs/provider.env`, then run `sudo systemctl restart cf-orbs-provider`.
3. **Check**

   Run `npx cf-orbs status` and look for a new start time and no `rejected` line. You can also run `npx cf-orbs logs --provider`.
4. **Revoke the old token**

   Revoke the old token in Amp.

If `status` still shows the old start time after 10 min, the Durable Object may still run old Worker code. This path is not yet tested on a live install. Run `cf-orbs deploy`, wait 2 min, and check again. If it happens again, report it on GitHub.

## If Amp rejects the token

The provider log shows `Error: Amp rejected the orb provider token`, and `init` stops with:

```text
Failed: Amp rejected the provider token (wrong or revoked) — fix: create a token in Amp Settings → Orbs → your provider, then cf-orbs init --token-file <file>
```

Make a new token and run `init` with it.

Source: https://cf-orbs-site.mdick85.workers.dev/docs/guides/rotate-token/index.mdx