How to rotate a Render environment variable

Updated October 2026

Render has two ways to update an environment variable, and one of them deletes every other variable on the service if you use it carelessly. The safe one updates a single key by name.

Here's the exact process, from Render's own docs.

The manual steps

1. Use the single-variable endpoint, not the bulk one: PUT https://api.render.com/v1/services/{serviceId}/env-vars/{envVarKey}, Authorization: Bearer <key>. Render's own API reference, checked December 8, 2026, documents this as the safer path for exactly this reason: the bulk PUT .../env-vars call takes "a full replacement array," so any variable you don't include in that array "gets deleted from the service."
2. If you do need the bulk call for some reason, GET the current list first and send every existing variable back, plus your change, never a partial array.
3. Trigger the deploy yourself: POST https://api.render.com/v1/services/{serviceId}/deploys. Render's own changelog is direct about this: changing an env var "does NOT auto-deploy," no matter what the service's auto-deploy setting says.
4. Poll GET /v1/services/{serviceId}/deploys/{deployId} until status reads live. Treat build_failed, update_failed, or canceled as a reason to roll the variable back.
5. Confirm the live app is actually using the new value before you retire the old credential anywhere else.

What breaks if you miss a place

Saving a new variable through the bulk endpoint without the full list wipes every variable you didn't resend, silently, in the same call that looked like it only changed one thing. That's a different failure mode than most providers in this series: the danger here isn't the old key outliving the new one, it's the deploy breaking entirely because other variables vanished with it.

How to check the old value is gone

Render's own GET on env vars returns the value in plain JSON, unlike most hosts, which mask secrets in their dashboard. Render's own reference confirms this. That's useful for confirming the new value landed, but Render itself notes this is the kind of behavior platforms change without a changelog entry, so don't build code that assumes it stays this way forever.

Why "does not auto-deploy" catches people

Most hosts in this series redeploy automatically on an env var change, or at least offer to. Render's own changelog makes a point of saying it doesn't, on purpose, regardless of your service's setting. That means a variable can sit "saved" in Render's dashboard for days while the running service never sees it, with nothing in the UI flagging that gap unless you know to check.

Or let Key Robot do it

Key Robot does this for you today. It writes the one variable, starts a deploy, waits until it is live, checks your app, and then deletes the old key at the service. If the check fails, it writes the old value back and deploys again.

In our live test on October 26, 2026, one change took 18 to 19 seconds on a free Render service. About 14 seconds of that was the deploy.

See how to rotate a Neon database password for a credential Key Robot already handles end to end, or the rotate hub for every service.