Rotating keys, and what to do when one leaks

#Rotate without downtime

An organization can have more than one key, so you can switch with no gap:

1. Create a second key under Developers → API keys, with the same allowed origins.

2. Deploy your site with the new key.

3. Watch Developers → Request logs until the old key shows no traffic.

4. Delete the old key.

Creating, regenerating, revealing and deleting keys all require that your session passed two-factor sign-in, and each is recorded.

#A secret key leaked

You pushed it to GitHub, pasted it in a chat, shipped it in a bundle. Do this now, in order:

1. Regenerate it. Developers → API keys, open the key, Regenerate. The old public and secret halves stop working on the next request. This is the step that matters; do it first.

2. Put the new secret where it belongs: your server's environment variables, then redeploy.

3. Check what happened. Developers → Request logs shows traffic per key and route, and Organization → Logs shows every change made. Look for writes you did not make.

4. Clean up the leak (remove the commit, delete the message), knowing the old key is already dead.

5. Tell us if you see changes you did not make.

A leaked public key is not an emergency: it is read-only and origin-locked. Regenerate it when convenient.