How to rotate your API keys, service by service

Updated October 2026

Rotating a key by hand is the same shape every time. Make the new one, put it everywhere the old one lived, check it works, then kill the old one. Miss a step and something breaks, usually days later, when nobody remembers which key is which.

Below is the exact manual process for six services, straight from each one's own docs, plus where Key Robot already does this for you.

Pick a service

• Stripe. The secret key is a Dashboard-only, human step. The webhook signing secret can be swapped by API.
• OpenAI. Keys are made and revoked in the OpenAI dashboard. Coming next on Key Robot.
• Supabase. New-style publishable and secret keys can run side by side while you switch. Coming next on Key Robot.
• Neon. The password inside your DATABASE_URL resets instantly, no grace period. Works today on Key Robot.
• Resend. Make a new key, remove the old one from the dashboard. Works today on Key Robot.
• Cloudflare. API tokens are made and managed under your profile or account settings. Coming next on Key Robot.

What "works today" actually means

Key Robot runs in your own GitHub Actions, on a schedule you don't manage. For Neon, Resend and Supabase keys on an app hosted on Netlify or Vercel, it makes a new key, checks your app still works with it, and deletes the old one. If the check fails, it puts the old key back by itself. There's also a Kill it now button for a key that just leaked. We timed it on our own demo app on October 23, 2026: 82 seconds from pressing the button to the old key being dead.

Keys are locked in your browser before anything is sent anywhere. They are saved as encrypted GitHub Actions secrets, in your own GitHub account. Key Robot's own server only ever sees names, dates, and results. It never stores a key.

What "coming next" means

Cloudflare and OpenAI support is built and is being tested right now. These are not ideas on a roadmap, they are code that exists and is being checked before it rotates a real app's keys.

What stays manual, for now

Stripe's secret key can only be rolled by a person, inside the Stripe Dashboard. Stripe has not published any API for creating one. The webhook signing secret is different. It can be created and swapped by API, so Key Robot can automate that half on its own. For the secret key itself, a person rolls it once, and Key Robot can handle everything else around that one manual click.

Free today, no card

All of this is free for one app. Pro covers all your apps for $19 a month, or $190 a year.

Why do this at all

A key that never changes is a key that's dangerous for as long as it exists. Most leaks don't come from a dramatic hack. They come from a key sitting in a .env file, a log line, or a screen share, for months, because nobody had a reason to replace it. A key on a daily rotation schedule is never more than a day stale, which shrinks the window a leaked key stays useful to almost nothing.

That's the actual case for automating this instead of doing it by hand once a year, if ever. Manual rotation works exactly once, the day you remember to do it, and then goes stale again until the next time someone remembers.

If a key already leaked, go straight to what to do when you leak an API key instead of working through rotation steps first. Kill the key, then come back here.