Rotate and Revoke Credentials

Rotate API keys when onboarding a new environment, changing operators, approaching expiry, or responding to potential exposure.

Rotate Without Downtime

API-key rotation is a replace-and-revoke flow:

1. Create or issue a replacement key for the same owner.
2. Store and deploy the replacement to the client.
3. Confirm the client is using the new key.
4. Revoke the old key.

For a personal key, use Account > API keys. For a service-account key, open Access > Service accounts, select the account, and use its API keys tab.

During a short overlap, both keys authenticate as the same user or service account and therefore have the same current access. A credential cannot be given a narrower role than another credential on the same owner.

Revoke One Key

Revoke a key when:

• it may have been exposed,
• it was committed to a repository or written to a log,
• the client no longer uses it,
• the operator or environment that held it is decommissioned,
• it was created for testing and is no longer needed.

Revoking a key disables only that credential. Other active keys for the same owner continue to work. A short-lived bearer token already issued from the revoked key can remain valid until that token expires.

An authorised administrator can revoke a member's personal key from Access > Members > member > API keys. The member can revoke it from Account > API keys.

Stop a Service Account

Use the account lifecycle when you need to stop every credential owned by a service account:

1. Suspend the account for a reversible stop that retains its access and audit identity.
2. Reactivate it when the account is eligible to resume.
3. Revoke account only for permanent retirement. Revocation cannot be undone.

Revoked service accounts remain available through Show revoked for audit.