Skip to content

Rotate API keys

When: on the schedule in the Maintenance calendar, when a volunteer leaves, or when a key may have leaked (do it immediately).

Principle: create the new key, deploy it, confirm it works, then revoke the old key. Never revoke first.

General steps

  • Find the key in the app's page under "Environment variables".
  • Create a new key in the provider dashboard.
  • Store it in the password manager vault.
  • Update the environment variable in each hosting platform.
  • Redeploy and check the app's health check.
  • Revoke the old key.
  • Log the rotation in the Decision log.

Per platform

  1. IAM, Users, select the user, Security credentials, Create access key.
  2. Update the key in Vercel/Railway/host settings.
  3. Redeploy and verify S3 access.
  4. Set the old key to Inactive, wait a few days, then delete it.
  1. Project Settings, API keys.
  2. Rotate the key you need. The service role key must never reach browser code.
  3. Update Vercel environment variables and redeploy.
  1. Project, Settings, Environment Variables.
  2. Edit the value for Production, then redeploy.
  3. Rotate any personal access tokens under Account Settings.

Document once adopted.

Note

Dashboard menus change. If a step does not match, check the provider's current documentation and update this page.