Rotate and Revoke API Keys

Rotate safely by creating a replacement key, storing it in your secret manager, deploying it to the intended service, confirming successful requests, and only then revoking the old key. Revoke immediately when a secret is exposed and investigate its usage before creating a replacement.

Last updated August 10, 2026

What is a zero-downtime rotation?

Plans with spare active-key capacity can keep old and new credentials active during the deployment window.

Create the replacement
Deploy and verify it
Revoke the previous key
Remove the old secret from storage

What if all active-key slots are used?

Choose a low-traffic window, identify an unused key to revoke, or temporarily consolidate carefully before creating the replacement.

When is immediate revocation required?

Revoke immediately after public exposure, unauthorized use, or loss of control. A normal scheduled rotation can use the overlap procedure.