Guides · Security

Rotate an API key without downtime

Kestrel keys don't expire, but you should replace one when someone leaves your team or a key may have leaked. Two keys can be live at once, so you can switch over without dropping a request.

Note

Only owners and admins can create or revoke keys. If you can't see API keys in Settings, read roles and permissions or ask an admin.

1. Create the new key

In Settings → API keys, choose Create key and give it a name you'll recognise later. Copy it straight away: we show the full key only once.

Tip

Name each key after where it runs and when you made it. When something breaks, production-2026-11 tells you more than key-3.

2. Switch your services

Put the new key in your secrets manager as KESTREL_API_KEY and redeploy. Requests signed with either key work until you revoke the old one.

# .env.productionKESTREL_API_KEY=kst_live_8f2c…a91d

Warning

Check the Last used column before you go on. If the old key was used in the last 24 hours, a service still has it, and revoking it will break that service.

3. Revoke the old key

Choose Revoke next to the old key and type its name to confirm.

Caution

Revoking can't be undone. Any request that still uses the key fails with 401 Unauthorized straight away. Read handling auth errors before you revoke a key in production.

Docs Callouts

More in this category