If you've migrated to the new API keys method, API keys can be rotated from the Settings page.
If your account is using the legacy Workflow Token and Secret, these are immutable and cannot be changed. This article will cover a workaround for the legacy Workflow Token and Secret.
As a workaround, legacy Workflow Token/Secret can be "rotated" by creating a new Workflow. The logic of the old Workflow can be copied into the new Workflow. Then update your API authentication to route the applications through the new Workflow.
The old Workflow can be archived to avoid confusion. Any evaluations that have run through the old Workflow can still be viewed in Alloy.