Rotate a secret key without downtime

Roll a key with a 24-hour overlap so you can deploy the new one before the old one stops working.

Updated 2 months ago 2 min read v3

On this page

Roll a key with a 24-hour overlap so you can deploy the new one before the old one stops working. Here is exactly what to do.

Steps#

Roll the key#
API keys → ⋯ → Roll key. Choose how long the old key keeps working.
Deploy the new key#
Update your environment variables and redeploy.
Confirm, then expire#
When the old key shows no traffic, expire it immediately.

Tip

Roll keys at least once a year, and right away if one leaks.

Include the request ID from the Relay-Request-Id response header — it lets us find your call in seconds.

Was this article helpful?