Rotate or revoke an API key
Replace secrets and stop access immediately.
Last updated · Oct 23, 2026
Rotate
Open Settings → API keys in the correct organization. Choose the key and rotate it. Copy the new secret into your server’s secret manager and update the integration. The previous secret becomes invalid immediately; plan the change to avoid an interruption. Verify a request with the new key succeeds and the old secret returns 401.
Revoke
Revoke a key when the integration is retired or the secret may have leaked. Revocation takes effect on subsequent requests and cannot be undone. Create a new key if access is needed again. Expired keys must also be replaced. Never send a secret to support; share the key name or identifier and a request ID instead.