Rotate an API Key

Use the primary and secondary secrets on a service-token API Key to rotate credentials without intentionally interrupting Workflow invocations.

This procedure applies only to service-token keys. Cookie and Delegate MCP user keys authorize signed-in users and do not have reusable secret values.

Before you begin

Confirm that you can update every consumer of the API Key. Also confirm which secret the consumers currently use. If that cannot be established, first move all consumers to one known secret and verify their requests.

Copy a newly generated secret immediately and put it in your secure secret manager. Flowgear shows the value only once.

Rotate the unused secret

1. Open API Keys from the main navigation.
2. Open the service-token key.
3. Identify the secret that no current consumer uses.
4. Click Regenerate beside that secret.
5. Confirm the action. Regeneration immediately invalidates the old value for that slot.
6. Copy the replacement value before leaving or refreshing the page.
7. Store the value securely.

Move consumers

1. Update each consumer to use the replacement secret.
2. Invoke an assigned Workflow through the key's target Environment hostname.
3. Confirm the invocation succeeds and produces the expected Workflow Log.
4. Confirm that every consumer has moved away from the other, older secret.

Complete the rotation

1. Return to the API Key details page.
2. Click Regenerate beside the remaining old secret.
3. Confirm the action.
4. Copy and store its replacement if you maintain both secrets for recovery.
5. Re-test representative consumers.

The key's name, enabled state, target Environment, and Workflow assignments do not change when either secret is regenerated.

If a secret is exposed

Regenerate the exposed slot immediately. Consumers still using that value will fail until updated. If you cannot identify which slot was exposed, disable the API Key to stop authorization, create a replacement key, update all consumers, and then delete the old key.