---
title: "Key rotation"
description: "Replace a private key without downtime, before it expires or after a leak."
canonical: "https://docs.nimbusmint.bot/authentication/key-rotation/"
---
> Index: https://docs.nimbusmint.bot/llms.txt

# Key rotation

Rotate a key when it is close to expiry, when someone who had access leaves, or straight away if you think it
has leaked. Ask for the new key as in [Get API keys](https://docs.nimbusmint.bot/get-keys.md).

## Planned rotation

Private keys expire at most **one year** after they are issued. Ask for the new key while the old one still
works, so the swap has no gap:

1. **Ask for a new key** a few weeks before the old one expires. It gets the same allowlist and scopes unless
   you ask for a change.
2. **Deploy the new key** to every server that calls the API.
3. **Check it works:** `GET /health` with the new key returns `200`.
4. **Ask us to revoke the old key.** Revocation takes effect within 10 seconds.

> **Do not let a key expire in production:** An expired key returns `401 invalid_key`, the same as a wrong key. Put the expiry date in your calendar
> when you receive the key.

## After a leak

Ask us to **revoke first**, then issue a replacement. Revoking is instant on our side (within 10 seconds); your
integration is down only until you deploy the new key. Then check how it leaked (a repository, a log line, a
shared screenshot) and close that path.

## With request signing

When [request signing](https://docs.nimbusmint.bot/authentication/request-signing.md) ships, the signing key pair is yours: you rotate it
by sending us a new public half. The exact steps will be published with the feature.