What is key rotation?
Key rotation means replacing a secret key, such as an API key or database password, with a brand new one and switching off the old one. You do it on a schedule, and immediately whenever a key might have leaked.
Also called: Rotating secrets
ON THIS PAGE
What it means
Keys are like house keys: the longer one exists, the more copies might be floating around in old code, chat messages, screenshots and old laptops. Rotating makes every old copy useless.
After a leak, rotation is the step that actually fixes it. Deleting the key from your code doesn't help, because anyone who already copied it can still use it until you revoke it.
Why it matters for vibe-coded apps
Most AI-built apps never rotate anything, and a key that leaked months ago may still be working.
- An old leaked key keeps working until it is revoked.
- If you don't know where a key is used, you can't safely change it in a hurry.
- A rotation routine means a leak is a small job, not an emergency.
Example
A payment key that has been the same since launch.
# Same key since launch, also pasted in Slack and an old repo
STRIPE_SECRET_KEY=sk_live_51Nx...# 1. Create a new key in the dashboard
# 2. Update the environment variable on your host
STRIPE_SECRET_KEY=sk_live_new...
# 3. Redeploy, check everything works
# 4. Revoke the old key in the dashboardKeep a short list of every key your app uses and where each one lives, so rotating takes minutes.
How to check if your app has this problem
- 1List every secret your app uses, and note when each was created.
- 2Search your repo, history and chat tools for keys that may have been shared.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Create the new key first, so nothing breaks.
- 2Update it in your hosting environment variables and redeploy.
- 3Revoke the old key once the new one works.
- 4Rotate on a schedule, and straight away after any suspected leak.
List every secret key and password my app uses and where each is read from. Then write me a step-by-step checklist to rotate each one without downtime, with the new key set via environment variables.
Check if your app has this problem
Paste your website and we'll check for key rotation issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- API key exposureA secret key for a paid service ends up where the public can see it.
- Environment variablesSettings stored outside your code, used to keep secrets out of it.
- Service role keyA Supabase key that skips every security rule, meant only for your server.
- GitHub secret scanningA GitHub feature that warns you when a password or API key is pushed to your repository.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.