Rotate API keys
Create a replacement key, move your servers to it, then revoke the old key when it is no longer in use.
Rotate keys regularly. If you suspect a key has leaked, revoke it immediately. During a routine rotation, the old key stays valid for 24 hours so your servers can move to the new one.
Overview
Section titled “Overview”| When | Old key | New key |
|---|---|---|
| You choose Rotate | Still works | Created, with the same permissions, and shown once |
| You deploy the new key | Still works | In use |
| 24 hours later | Stops working | In use |
Rotate in the dashboard
Section titled “Rotate in the dashboard”- Open API Keys, in the environment of the key.
- Choose Rotate on the key. A live key asks for your second factor.
- Copy the new key now. It is shown once. It has the same permissions as the old one.
- Put the new key in your servers’ secret store and deploy.
- The old key stops working by itself after 24 hours. If you want it to stop sooner, once nothing uses it, choose Revoke on it.
A smooth change
Section titled “A smooth change”- Deploy the new key everywhere before the 24 hours are over, and watch for
invalid_api_keyanswers: they mean something still sends the old key after it ended. - Check the allowed addresses and the expiry date of the new key in the list: it is a new key, with the permissions of the old one.
- If a key leaked, do not wait: revoke it first, then make a new key and deploy it.