What is a safe key rotation?
A safe rotation replaces a credential without interrupting its application. Create a new named key with the intended CORS origins and Pro cap, store it in the secret manager, deploy it to the service, and verify successful requests. Only then revoke the previous key and remove its secret. Plans with spare active-key capacity can keep both credentials valid during the controlled overlap.
When should a key be revoked immediately?
Revoke without a normal overlap window when the secret has appeared in public source control, a browser bundle, logs available to unintended readers, a screenshot, an exposed support message, or unexplained usage. Review the key's request count and last activity, preserve operational evidence without preserving the secret, and create a clean replacement. Rotation alone is incomplete if the compromised key remains active.
How do immutable settings affect rotation?
CORS origin lists and Pro key caps are selected at creation and cannot be edited on that credential. Recreating a key is therefore the supported way to change either control. Prepare the new configuration carefully, test every intended origin or workload, and use descriptive names that distinguish replacement from predecessor. Revoke the old key promptly after rollout so it cannot become a forgotten alternate path.
What if all active-key slots are occupied?
Identify a genuinely unused key through ownership, deployment records, last use, and request totals before revoking it. If every key is live, choose a low-risk maintenance window or temporarily consolidate a noncritical workload with care. Free's single active slot cannot provide overlap, while Starter's 2 and Pro's 5 make planned rotation easier when one slot remains available.
How do I verify the replacement?
Send a known lookup with the new secret from the actual deployment environment, not only a laptop. Confirm authentication, any exact Origin requirement, expected Pro cap in usage data, response parsing, and monitoring attribution. The request below validates the lookup path; GET /usage then validates activity and remaining capacity for the new key.
curl --fail-with-body --max-time 10 \
-H "Authorization: Bearer $IPROUT_API_KEY" \
https://api.iprout.com/ip/8.8.8.8How often should routine rotation occur?
Choose a schedule that matches organizational risk and operational maturity, then automate secret deployment where possible. More frequent rotation is not valuable if old keys remain active or applications cannot identify which credential they use. Review keys regularly, revoke retired integrations, and maintain an emergency procedure so exposure response does not depend on rediscovering dashboard and deployment steps under pressure.
Which IPRout plan fits this workload?
Use the 7-Day Developer Key for a short evaluation with 1,000 requests. Free supports ongoing low-volume use with 10,000 monthly requests and 1 active key. Starter adds 100,000 requests, 2 active keys, and up to 5 exact CORS origins per key. Pro provides 1,000,000 requests, 5 active keys, up to 10 origins per key, and a configurable 100 to 1,000,000 request cap when each key is created. All active account keys consume one shared monthly allowance.
| Plan | Monthly requests | Active keys |
|---|---|---|
| Free | 10,000 | 1 |
| Starter | 100,000 | 2 |
| Pro | 1,000,000 | 5 |
What are the key benefits?
This feature uses the same authenticated HTTPS interface and predictable JSON conventions as the rest of IPRout. That keeps the integration small while letting teams separate product logic from the details of IP intelligence and API key controls.
- Overlap keys during rotation
- Revoke compromised credentials
- Retire unused integrations
How do I get started?
Generate a 7-Day Developer Key for evaluation or create an account key for an ongoing integration. Begin with the documented request, add status-aware error handling and a finite timeout, then connect only the response fields your product needs. Review usage before launch, keep the secret in trusted infrastructure, and follow the linked documentation for feature-specific configuration.