Rotate a credential safely

Rotation workflow

1. 1
   Create

   Create a new credential with the permissions the integration needs. Keep the old credential active.

2. 2
   Deploy

   Store the new secret in the integration's secret manager and deploy it.

3. 3
   Observe

   Verify successful requests and confirm the new credential's last-used timestamp.

4. 4
   Revoke

   Revoke the previous credential after all callers have migrated.

Verify the migration

Make a low-risk request such as GET /organization, inspect your integration telemetry, and confirm that production workers no longer use the previous credential.

Revoke the old key

Revocation is immediate and idempotent. A revoked credential receives the same generic 401 as every other invalid credential. It cannot be restored.