Rotate API keys

​

Preparation

• Identify every runtime, worker, scheduled task, and secret reference using the old key.
• Record the old key’s name and scope without copying the secret value.
• Confirm who has the required IT, HR, or Company-Admin portal permission.
• Choose a maintenance window if the client cannot reload secrets dynamically.
• Prepare a rollback path that re-enables the old key only when it is still trusted.

​

Rotation flow

​

Verification requests

curl --request GET \
  --url 'https://api.jobhandy.io/v1/employees?page=1&pageSize=1' \
  --header 'X-API-Key: REPLACEMENT_API_KEY' \
  --header 'X-Request-ID: {{requestId}}'

​

Emergency replacement

1. Deactivate it immediately.
2. Stop affected integration instances if necessary.
3. Review request IDs, times, tenants, and operations in available logs.
4. Create a replacement with the minimum required scope.
5. Deploy and verify the replacement.
6. Delete the old key when the investigation and rollback decision permit.

​

Completion checklist

• Every runtime uses the replacement secret version
• A protected request succeeded for every required tenant context
• No new INVALID_API_KEY failures are caused by stale instances
• The old key is inactive
• The old key is deleted when rollback is no longer required
• Rotation date, operator, scope, and verification request IDs are recorded