Rotate an API key
Rotating means replacing a key with a new one without downtime. Syntic has no single “rotate” button: you create a new key, switch your service over, then revoke the old key.
Rotate without downtime
Create the new key
In the Console, select the same organization and create a key with the same type. Give it a name that marks it as the new one, for example “billing-service 2026-10”. See Create an API key.
Store it
Put the new key into your secret store or server configuration, next to the old one.
Deploy
Restart or redeploy every service that used the old key so it reads the new value.
Check the old key is idle
On the API Keys page, watch the old key’s Last used time. When it stops moving, nothing is using it any more.
Revoke the old key
Choose Revoke on the old key and confirm. See Revoke an API key.
When to rotate
- Right away, if a key may have been exposed. In that case revoke the exposed key first and accept a short outage; a leaked key can run up usage on your organization’s bill.
- When someone who had access to the key leaves your team.
- On a regular schedule your security policy sets, for example every 90 days.
Keys made in the Console have no expiry date. They keep working until revoked, so scheduled rotation is up to you.
Changing a key’s settings
You can’t edit a key after it’s created. To change its name, type or allowed origins, follow the same rotation steps with the new settings.
Keep a slot free
Each member can have 20 active keys per organization. During a rotation both keys count, so keep at least one slot free.