> ## Documentation Index
> Fetch the complete documentation index at: https://learn.biq.li/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate and revoke API keys

> Replace compromised credentials and remove API access safely.

API keys cannot be edited into a new secret. To rotate one, create a replacement with the required permissions, store it securely, update the integration, and verify a request with the new key.

After every consumer has switched, revoke the old key. Revocation is immediate and requests using that secret will fail authentication.

If a key might be exposed, revoke it as soon as a replacement is ready. Review logs and last-used information for unexpected activity, but do not write the secret itself to a log.

## Planned rotation

1. Record the old key name, permissions, and known consumers without copying
   the secret into a ticket.
2. Create a new key with the same or narrower required access.
3. Update one environment at a time.
4. Test an authenticated read and every required write operation.
5. Revoke the old key after all consumers have moved.
6. Confirm requests with the old key return an authentication error.

## Emergency revocation

When misuse is active, revoke first, then restore the integration with a new
key. Tell affected teams to stop retry loops so invalid-token traffic does not
obscure investigation.

Revocation is permanent. Editing a key's name or permissions is not a substitute
for replacing a secret that may have been copied.

Use one key per consumer so a single revocation does not interrupt unrelated
applications.