# Rotate and Revoke Credentials

> Safely replace or disable personal and service-account API keys.

Rotate API keys when onboarding a new environment, changing operators, approaching expiry, or responding to potential exposure.

If a trusted key is only approaching its expiry, you can instead select **Remove expiry** beside the key to keep it working without redeploying. Rotate instead when the key may have been exposed or its holder has changed.

## Rotate Without Downtime

API-key rotation is a replace-and-revoke flow:

1. Create or issue a replacement key for the same owner.
2. Store and deploy the replacement to the client.
3. Confirm the client is using the new key. The key list shows when each key was **Last used**.
4. Revoke the old key.

For a personal key, use the user menu > **API keys**. For a service-account key, open **Access management** > **Service accounts**, select the account, and use its **API keys** tab.

During a short overlap, both keys authenticate as the same user or service account and therefore have the same current access. A credential cannot be given a narrower role than another credential on the same owner.

## Revoke One Key

Revoke a key when:

- it may have been exposed,
- it was committed to a repository or written to a log,
- the client no longer uses it,
- the operator or environment that held it is decommissioned,
- it was created for testing and is no longer needed.

Revoking a key disables only that credential. Other active keys for the same owner continue to work. The revoked key can no longer be exchanged for new tokens.

Tokens already issued from the revoked key behave differently depending on their audience:

<table>
<thead>
  <tr>
    <th>
      Token audience
    </th>
    
    <th>
      After the key is revoked
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        infuse-platform
      </code>
    </td>
    
    <td>
      Rejected on the next request.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        infuse-iot
      </code>
    </td>
    
    <td>
      Can remain usable until the token's <code>
        expiresAt
      </code>
      
      .
    </td>
  </tr>
</tbody>
</table>

If an exposed key had `infuse-iot` tokens in use, allow for this short window. Removing a member from the organisation stops their personal keys' IoT access on the next request. Suspending a service account also stops its IoT access, although the change can take a short time to reach Infuse IoT.

An authorised administrator can revoke a member's personal key from **Access management** > **Members** > member > **API keys**. The member can revoke it from the user menu > **API keys**.

## Stop a Service Account

Use the account lifecycle when you need to stop every credential owned by a service account:

1. **Suspend** the account for a reversible stop that retains its access and audit identity.
2. **Reactivate** it when the account is eligible to resume.
3. **Revoke account** only for permanent retirement. Revocation cannot be undone.

Revoked service accounts remain available through **Show revoked** for audit.

<note>

Rotating an IAM API key does not affect legacy Infuse IoT admin keys, which are deprecated and being retired. Instead of rotating a legacy key, [migrate the integration](/docs/iam-and-access/api-tokens#legacy-infuse-iot-admin-keys) to an IAM API key.

</note>