Rotate secrets without breaking production
Most teams never rotate API keys because they’re afraid of downtime. Design for two valid keys at once and it becomes boring.
Ask a team when they last changed their database password or payment API key. Often the answer is “when we set it up”. The reason is fear: change it and something, somewhere, stops working.
The trick is to never have only one valid secret during the change.
- Create a second key or password alongside the old one. Most providers allow two.
- Deploy the new one to every app and server that uses it.
- Watch the logs until nothing uses the old one.
- Revoke the old one.
To make this possible, keep secrets in one place, a secrets manager or your platform’s secret store, not in code or copied across five config files. Then you know exactly where each one is used.
Practise on a quiet day. When a key leaks, you’ll do it in an hour instead of a week.