# Rotating keys, and what to do when one leaks

> Rotation without downtime, and a five-minute leak checklist.

Source: https://docs.dashfordevs.com/v1/authentication/rotate-and-leaks · Topic: API keys and authentication · Updated: 2026-11-07

## Rotate without downtime

An organization can have more than one key, so you can switch with no gap:

1.  **Create a second key** under **Developers → API keys**, with the same allowed origins.
    
2.  **Deploy your site with the new key.**
    
3.  **Watch** **Developers → Request logs** until the old key shows no traffic.
    
4.  **Delete the old key.**
    

Creating, regenerating, revealing and deleting keys all require that your session passed two-factor sign-in, and each is recorded.

## A secret key leaked

You pushed it to GitHub, pasted it in a chat, shipped it in a bundle. Do this now, in order:

1.  **Regenerate it.** **Developers → API keys**, open the key, **Regenerate**. The old public and secret halves stop working on the next request. This is the step that matters; do it first.
    
2.  **Put the new secret where it belongs**: your server's environment variables, then redeploy.
    
3.  **Check what happened.** **Developers → Request logs** shows traffic per key and route, and **Organization → Logs** shows every change made. Look for writes you did not make.
    
4.  **Clean up the leak** (remove the commit, delete the message), knowing the old key is already dead.
    
5.  **Tell us** if you see changes you did not make.
    

A leaked **public** key is not an emergency: it is read-only and origin-locked. Regenerate it when convenient.