Help Tutorials
Rotate an API key without downtime
In-place Rotate kills the old secret the instant the new one exists, so any server still using it fails until you redeploy. For zero downtime, overlap two keys:
- API Keys → open the key → note its scope and permissions.
- Create key with the same scope and permissions, and a name like
billing-handler-2026-11. - Copy the secret straight into your secret manager. You won't see it again.
- Deploy your service with the new secret.
- Back on the old key, watch Last used. It updates at most once a minute. When it's stopped moving for longer than your slowest job's interval, nothing is using it.
- Revoke the old key. The audit log records
api_key.revoked.
If Last used keeps moving after the deploy, something you missed still has the old secret. Find it before you revoke.
Screens in this tutorial
KEY-01 · API keys KEY-02 · Create API key KEY-03 · Secret reveal KEY-04 · API key detail