Skip to main content

Rotate an API key without downtime

Scopes: tenancy:read, tenancy:write (an owner's key). Rotation is in the credentials rate class: 10 a minute.

1. Find the key​

curl -s "https://api.zaitrack.app/v1/api-keys" -H "Authorization: Bearer $KEY" | jq '.apiKeys'

The list never holds secrets.

2. Rotate it​

curl -s -X POST "https://api.zaitrack.app/v1/api-keys/$KEY_ID:rotate" \
  -H "Authorization: Bearer $KEY" \
  -H "Idempotency-Key: $(uuidgen)" | jq

The response holds the new key's secret, once, with the same scopes as the old key. Store it in your secret manager now.

3. Switch over​

The old key keeps working for 30 days (or until it expires, if sooner), so deploy the new secret at your own pace. Once every service uses it, revoke the old key:

curl -s -X POST "https://api.zaitrack.app/v1/api-keys/$OLD_KEY_ID:revoke" \
  -H "Authorization: Bearer $NEW_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

It stops working within 30 seconds. Developer Studio does the same from a key's page, and shows each key's use per day.