Automated API Key Rotation

Rotate keys automatically without downtime. Security best practices on autopilot.

What You'll Build

A secret rotation system that:

• Rotates API keys on a schedule (weekly, monthly, or custom)
• Updates environment variables across all services
• Maintains backward compatibility during transition
• Logs all rotations with audit trail

Requirements

• Plugins: Vercel, Render (for env var updates)
• Time: 20 minutes

Setup

1. Define Rotation Schedule

Rotate these secrets: - OpenAI API key: every 30 days - Database password: every 90 days - Stripe API key: every 60 days - GitHub token: every 180 days Alert me 7 days before rotation.

2. Configure Services to Update

After generating new key: 1. Update env var on Vercel (all projects) 2. Update env var on Render (all services) 3. Update in password manager 4. Redeploy services 5. Verify new key works 6. Revoke old key after 24h grace period

3. Set Up Dual-Key Period

Rotation strategy: - Day 0: Generate new key, keep old key active - Day 0-1: Both keys work (grace period) - Day 1: Revoke old key, only new key works This ensures zero downtime.

4. Create Audit Log

Log every rotation: - Timestamp - Service/key rotated - Old key (last 4 chars) - New key (last 4 chars) - Who triggered (auto or manual) - Status (success/failed) Export to CSV monthly for compliance.

Sample Rotation

7 Days Before:

⚠️ Upcoming Key Rotation Service: OpenAI API Current key: sk-...x7K2 (expires in 7 days) Next rotation: Feb 18, 2024 Action required: None (auto-rotation enabled) Reply SKIP to postpone by 30 days.

Day of Rotation:

🔄 Key Rotation Started Service: OpenAI API Old key: sk-...x7K2 New key: sk-...j9M1 Progress: ✅ New key generated ✅ Added to Vercel env vars ✅ Added to Render env vars ⏳ Redeploying services (2/4)...

After Completion:

✅ Key Rotation Complete Service: OpenAI API New key: sk-...j9M1 All services updated: 4/4 🕐 Grace period: 24 hours Old key (sk-...x7K2) will be revoked tomorrow. [View audit log →]

24 Hours Later:

🗑️ Old Key Revoked Service: OpenAI API Revoked key: sk-...x7K2 All services confirmed working with new key. Rotation complete. Next rotation: Mar 20, 2024.

Pro Tips

1. Test First: Rotate in staging environment before production
2. Alerting: If any service fails health check after rotation, auto-rollback
3. Compliance: Generate SOC 2 compliance reports from audit logs
4. Emergency Rotation: Trigger immediate rotation if key is leaked

---

Secure your infrastructure → Launch Claws