API Key Rotation

Overview

API Key Rotation is the controlled replacement of an API key with a new key before or after the old credential becomes unsafe or expires. It is used to limit the duration and impact of credential exposure while maintaining service continuity. It differs from simple key deletion, which can cause an outage if consumers have not switched.

A typical implementation works as follows: An operator creates a new key, distributes it through an approved secret store, updates clients, verifies use, disables the old key, and records completion. Evidence for API Key Rotation should record the credential or certificate identifier and decision result without retaining the secret itself.

Common risks include unknown key owners and hard-coded secrets. Important failure modes include unknown key owners, hard-coded secrets, overlapping credentials, failed deployment, and premature revocation. These failures can interrupt payments or leave unused keys active.

Core controls require teams to maintain inventory and ownership, support overlap, automate distribution, monitor key usage, test rollback, and revoke promptly after compromise. The API Key Rotation recovery process should restore access without bypassing the original identity and authorization controls.

Operational evidence should include key identifier, owner, creation and expiry, last use, consuming service, rotation ticket, and revocation time. API Key Rotation should be documented alongside Access Token, Credential Store, and API Client. Monitoring for API Key Rotation should track failed use, unusual scope or audience, expiry, rotation status, and attempts involving revoked credentials.

Least-privilege configuration for API Key Rotation should be verified against the operations used by each environment and consuming service.