free-ai-api-keys

Rotating API keys

Published 2026-10-16 · Updated 2026-10-21

Key rotation means replacing a live credential with a fresh one. There are two flavors: scheduled rotation as hygiene, and emergency rotation after a leak. The mechanics differ.

Scheduled rotation

Do it when you have more than one person touching the infrastructure, or on whatever cadence your security posture calls for, quarterly is common, monthly for sensitive workloads.

The safe sequence:

  1. Create the new key in the provider console before touching the old one.
  2. Deploy it to your environment/secret store.
  3. Verify, hit /models from the production environment with the new key.
  4. Wait a propagation window (a few minutes is plenty for stateless APIs; watch for long-running jobs still holding the old value).
  5. Revoke the old key.

Revoking before deploying is how you take your own service down.

Emergency rotation

If a key was committed to a repo, pasted into a log, or shown in a screenshot: it’s compromised, whether or not you see abuse yet. Provider scanners typically revoke exposed keys automatically within hours, assume yours is flagged.

  1. Revoke first. Don’t deploy-then-revoke when the key is public; the exposure window is what matters.
  2. Create and deploy the replacement.
  3. Check usage. Every provider console shows request volume per key. A spike that isn’t yours is the answer to whether it was used.

When working through shared keys

If you run through a list of community keys, the rotation is the whole workflow: pick the freshest verified key, use it until it 401s or 402s, take the next. Automating the fallback, catch the error, rotate to the next key in the list, retry once, turns “the key died” from an outage into a non-event.

for key in key_pool:
    client = OpenAI(api_key=key, base_url=base)
    try:
        return client.chat.completions.create(...)
    except Exception as e:
        if "401" in str(e) or "402" in str(e):
            continue
        raise
raise RuntimeError("no working keys left")

Operational notes