How to rotate your Turso database token

Updated October 2026

Turso has no way to end just one token. It can only end every token of a database at once. So rotating TURSO_AUTH_TOKEN always means a short gap: end the old tokens, make a new one, and get it into your app fast.

The manual steps

1. List every app that uses the database. All of them lose access in step 2, not just one.
2. End all tokens for the database with the invalidate tokens call (POST /v1/organizations/{org}/databases/{db}/auth/rotate).
3. Wait a second, then make a new token with the create token call.
4. Put it in every app from step 1, and redeploy.

What breaks if you miss a place

Every app on that database is cut off from step 2 until it gets the new token. One you forgot stays cut off. There is no undo: the old tokens cannot be brought back.

A token made too soon is born dead

We found this in our own test. The reset ends every token stamped at or before its own second. A token made in that same second never works. Tokens made 3 seconds or more after the reset all worked. So wait a moment, and test the new token before you hand it to your app.

How to check the new token works

Run SELECT 1 over Turso's HTTP endpoint with the new token. The old token should now get a 401.

Or let Key Robot do it

Key Robot does this for you today, as a one-way change: about a 15-second gap while your app switches, and no undo. It ends the old tokens, waits, proves the new token works, puts it in your app on Netlify, Vercel, Render, Railway or Cloudflare Workers, and redeploys. If your app check fails afterwards, it keeps the new token and tells you, because the old one is gone. It only ever touches the one database you name.

In our live test on October 26, 2026, the change took 14 seconds, and the app had no working token for 13.8 of them.

See how to rotate a MongoDB Atlas password for a database with no gap, or the rotate hub for every service.