Rotate your API credentials without downtime

Until today, every application had exactly one server API key and secret. Rotating them meant swapping the pair and hoping every deploy picked up the new values at the same moment. In practice, that meant downtime.

That’s fixed. Your application can now hold two active credentials at once.

Rotating is now four unremarkable steps:

1. Create a second credential from the new Credentials tab.
2. Deploy it alongside the old one — both authenticate.
3. Watch Last used on the old credential stop advancing.
4. Revoke it.

Step three is the one that makes this safe. You’re not guessing whether something still holds the old key: the page tells you when it last authenticated, so you revoke on evidence rather than hope.

You’ll find it all under Credentials on your application.