brokenrobot-xyz Rotate an API key
Rotate one service's key with an overlap window, so no consumer loses access mid-rotation.
Steps
- Set up the replacement key in the provider console and point the staging consumer to it.
- Verify staging traffic against the replacement key before you touch production, because a bad key caught in staging costs a retry instead of an outage.
- Update each production consumer to the replacement key, one consumer at a time.
- Don't retire the old key before every consumer reports healthy on the replacement, because an early retirement cuts off every consumer still on the old key.
- Retire the old key and log the rotation date.