How to rotate your Algolia API key

Updated October 2026

Make a new Algolia key with the same rights as the old one, put it in your app, then delete the old key. A new key never ends the old one, so you can switch with no gap.

The manual steps

1. Open API keys in your Algolia dashboard and pick your application.
2. Make a new key with the same rights (ACL), indexes and limits as the one your app uses now.
3. Update every place the old key lives. Your host's environment variables and any front end that ships a search key.
4. Delete the old key once everything runs on the new one.

What breaks if you miss a place

Search stops working anywhere that still holds the old key, the moment you delete it. Algolia also makes and deletes keys in the background, so a brand new key can take a moment before it answers.

How to check the old key is actually dead

Call GET /1/keys/{key} with the old key. Algolia's docs let any key read its own rights, so this is a free, read-only check. A deleted key is refused.

The Admin key is different

The Admin API key can make and delete every other key. Only a person can make a new one, in the dashboard. Keep it on your server, never in a front end.

Or let Key Robot do it

Key Robot does this for you today, with your Admin key and Application ID. It makes the new key with the same rights, indexes and limits, puts it in your app on Netlify, Vercel, Render, Railway or Cloudflare Workers, checks your app still works, and then deletes the old key. It never makes an admin key, never changes your Admin key, and deletes only keys it made.

In our live test on October 26, 2026, one change took 16 seconds, and Algolia refused the old key 2.3 seconds later.

See how to rotate your OpenRouter key for another service where both keys work during the switch, or the rotate hub for every service.