Rotate a key when its owner, purpose or exposure changes, and remove credentials that no longer serve an active integration. A useful rotation procedure identifies every consumer before revoking a working key.
Inventory the consumers
Find the servers, workers and scheduled jobs that load the credential. Check deployment configuration rather than searching only application source. A key can still be used by an old job even when the main application has moved to a new configuration.
Write down the required scopes and the organization. Avoid copying the secret into the inventory. A recognizable key name and integration owner are enough for ordinary operational records.
Create and distribute the replacement
Create a new key with the smallest permission set that supports the current integration. Save its once-shown value in protected secret storage, then update the relevant server configuration.
Verify a harmless read that exercises a required scope. A public health request does not prove the replacement key works. If the integration writes records, verify the permission configuration and use your normal controlled test process for those actions rather than sending an unsolicited production mutation.
Revoke after verification
Once the new key is active across all consumers, revoke the old key. Revocation takes effect immediately. Watch for 401 responses from overlooked jobs and fix their configuration rather than restoring a widely shared credential by habit.
A 403 after rotation often indicates a missing scope on the replacement. Review the specific endpoint instead of granting every permission to make the error disappear.
Handle suspected exposure
When a key may have been exposed, containment can take precedence over a seamless rollout. Revoke the affected credential, identify its permissions and review the integration's records. Keep credentials out of incident messages and general logs.
Do not confuse this process with webhook secret rotation. API keys authorize outgoing requests from your server. Webhook secrets verify incoming deliveries, and their replacement behavior differs.