Key rotation

Rotate a key when it is close to expiry, when someone who had access leaves, or straight away if you think it has leaked. Ask for the new key as in Get API keys.

Planned rotation

Private keys expire at most one year after they are issued. Ask for the new key while the old one still works, so the swap has no gap:

1. Ask for a new key a few weeks before the old one expires. It gets the same allowlist and scopes unless you ask for a change.
2. Deploy the new key to every server that calls the API.
3. Check it works: GET /health with the new key returns 200.
4. Ask us to revoke the old key. Revocation takes effect within 10 seconds.

Do not let a key expire in production

An expired key returns 401 invalid_key, the same as a wrong key. Put the expiry date in your calendar when you receive the key.

After a leak

Ask us to revoke first, then issue a replacement. Revoking is instant on our side (within 10 seconds); your integration is down only until you deploy the new key. Then check how it leaked (a repository, a log line, a shared screenshot) and close that path.

With request signing

When request signing ships, the signing key pair is yours: you rotate it by sending us a new public half. The exact steps will be published with the feature.