Key rotation

Key rotation replaces a credential with a fresh one.

For planned rotation, use zero-downtime ordering: create the new key, deploy it everywhere, wait for deployments to roll, confirm the old key shows no recent usage, then revoke.

For an active compromise, invert it — revoke first and take the outage. Every minute of a graceful rollout is a minute someone else is spending your money. How to revoke an OpenAI API key.