API Key Rotation: Revoking Access and Updating Deployments
Edited by Steinar Vigdel Kolnes, Editor, Oslo
Rotating an API key involves separate steps: disabling the old credential and updating applications to use its replacement.
API key rotation addresses two distinct tasks: withdrawing access granted by an existing credential and configuring applications to use a new one. Completing one does not necessarily complete the other.
Revocation invalidates the old key for future authentication, subject to the provider’s implementation. It does not reverse actions already performed with that credential or automatically replace copies stored in application settings.
Redeployment can move an application onto a replacement key, but it does not itself guarantee that the previous key has been revoked. If the old credential remains valid, updating the application alone leaves that access route open.
Source: The Defiant
