Skip to main content
API keys cannot be edited into a new secret. To rotate one, create a replacement with the required permissions, store it securely, update the integration, and verify a request with the new key. After every consumer has switched, revoke the old key. Revocation is immediate and requests using that secret will fail authentication. If a key might be exposed, revoke it as soon as a replacement is ready. Review logs and last-used information for unexpected activity, but do not write the secret itself to a log.

​
Planned rotation

  1. Record the old key name, permissions, and known consumers without copying the secret into a ticket.
  2. Create a new key with the same or narrower required access.
  3. Update one environment at a time.
  4. Test an authenticated read and every required write operation.
  5. Revoke the old key after all consumers have moved.
  6. Confirm requests with the old key return an authentication error.

​
Emergency revocation

When misuse is active, revoke first, then restore the integration with a new key. Tell affected teams to stop retry loops so invalid-token traffic does not obscure investigation. Revocation is permanent. Editing a key’s name or permissions is not a substitute for replacing a secret that may have been copied. Use one key per consumer so a single revocation does not interrupt unrelated applications.