Skip to main content
Rotating API keys regularly limits the blast radius of a leaked credential. Kosli supports zero-downtime rotation for service account API keys: a new key is issued immediately while the old key remains valid for a configurable grace period.

​
How rotation works

When you rotate a service account API key, Kosli:
  1. Generates a new API key and returns its value once.
  2. Keeps the old key valid for a configurable grace period (default: 24 hours).
  3. Automatically revokes the old key when the grace period expires.
Choose a grace period that fits your deployment cadence — long enough to roll the new key out to every consumer, short enough to limit exposure.

​
Where next

Last modified on June 5, 2026