If keys are never rotated, keys become permanent liabilities.
Start here:
The rule: rotation is normal operations
Rotation should be routine:
- quarterly (common default), or
- whenever a vendor changes, or
- whenever a developer leaves, or
- whenever suspicious usage is detected
If your process treats rotation as "special", it will never happen.
"Shown once" keys are a feature
A good API key system shows the full key only once, at creation/rotation time.
Benefits:
- reduces accidental disclosure in UIs
- forces better secret handling discipline
- encourages vault usage and proper deployment pipelines
A minimal rotation checklist
- Rotate the key (generate new secret)
- Update the consuming system (deploy)
- Confirm traffic is using the new key (usage timestamps/counters)
- Revoke the old key
- Record why rotation happened (auditability)
Revocation should be immediate
Revocation is your "stop the bleeding" lever.
If revocation takes hours, the safe move becomes "do nothing", which is how incidents grow.
What to do next
- Implement scoped keys with rate limits: API key management (Dubai)
- For real-time events, avoid polling: ERP webhooks (Dubai)