Key rotation

What it means

Key rotation replaces credentials, API keys, signing keys and certificates on a schedule rather than leaving them in place for years. Nobody has to prove the old value leaked. The point is that if it ever did, its usefulness has an end date.

Done properly it is dull. You issue a new value, run both for a short overlap, let systems pick up the new one, withdraw the old one, and nothing falls over.

Why it matters

Credentials escape in ways you never learn about. A laptop, a log file, a screenshot in a support ticket, a contractor's machine, a repository that sat public for an afternoon. Rotation is the one control that does not depend on knowing any of that happened. It is also your first move after finding a hardcoded secret.

Google's key management documentation recommends automatic rotation on a regular schedule and gives 90 days as an example period. OWASP adds the part teams skip: build and test the rotation process before you need it, so you can move quickly during an incident.

How it shows up

Rotation itself rarely breaks. The forgotten copy breaks. A value pasted into a scheduled job, a partner integration set up three years ago, a mobile app that needs resubmitting to the store. Something fails at an awkward hour, the change gets rolled back, and nobody tries again.

Two habits cover most of it. Support an overlap so old and new both work for a defined window, and rehearse somewhere safe while it is not urgent. Nobody rotates a key well for the first time during an incident, which is the only moment it truly matters.