How to rotate your Resend API key

Updated October 2026

Create the new Resend key in the dashboard, put it everywhere your app sends email from, confirm it works, then remove the old key. Resend never shows you a key's value a second time, so save it the moment it's created.

Here's the manual process, from Resend's own docs.

The manual steps

1. Create a new key on the API keys page in your dashboard, with a name, a permission level, and an optional domain restriction.
2. Copy the value immediately. Resend's docs are explicit: you "cannot view or edit an API key value after it has been created." If you lose it, you have to make another one.
3. Update every place the old key is used. Your app's environment variables, any CI secrets, and any serverless function that sends email through Resend.
4. Remove the old key. In the dashboard, click More options next to the key you're retiring, then select Remove API key.

Resend's own docs cover every step above, checked October 24, 2026.

What breaks if you miss a place

Anything still holding the old key stops authenticating once it's removed, the same way any revoked API key does. Resend's own documentation does not spell out whether that happens instantly or after a short delay, and it doesn't call out what happens to webhooks or SMTP credentials specifically if you forget to update them. Treat every integration that sends mail through Resend as a place to check by hand, not something to assume is covered.

How to check the old key is actually dead

Since the exact timing isn't documented, test it directly. Send one request using the old key after removing it. An authentication failure means it's gone. If the request still succeeds, give it a little time and test again before you trust that it's dead.

Or let Key Robot do it

This works today. Key Robot rotates Resend keys for apps hosted on Netlify, running from your own GitHub Actions. It creates the new key, checks that your app can still send mail with it, and only deletes the old key once that check passes. If the check fails, it puts the old key back automatically, so you're never caught with email broken and no working key.

There's also a Kill it now button for a key that leaked right now, outside the daily cycle. We timed it on our own demo app on October 23, 2026: 82 seconds from pressing the button to the old key being dead.

Your key is locked in your browser before anything is sent, then saved as an encrypted GitHub Actions secret in your own GitHub account. Key Robot's own server only ever sees names, dates, and results, never the key itself. Free for one app, no card.

Naming keys so rotation doesn't get confusing

Resend lets you name each key when you create it. Use a name that tells you what it's for and when it was made, something like the service and the date, not "prod" or "key2." When you're looking at a list of keys later trying to figure out which one is safe to remove, a clear name is the difference between a confident delete and a guess.

See how to rotate your Neon database password for the other service already live, or the full rotate hub for everything still coming. If a Resend key already leaked, go straight to what to do when you leak an API key.