Technical Playbook · Security · Secrets Management
API Key Rotation Playbook
A practical process for rotating API keys, database credentials, and third-party secrets on a schedule — written for developers running their own applications on a Hoststack VPS with root access.
See Linux VPS PlansWhy Rotate Keys on a Schedule
Credential rotation limits the blast radius of a leaked key — the goal isn't to prevent every leak, but to make any single leaked credential expire quickly.
Time-Bounded Exposure
A key rotated every 90 days limits how long a leaked or forgotten credential remains valid, even if you never notice the leak.
Separate Keys Per Environment
Staging, production, and CI/CD should each use distinct API keys — a leak in one environment doesn't compromise another.
Inventory Before Rotation
You can't rotate what you don't know exists — a full inventory of which services hold which keys is the essential first step.
Root Access for Secret Storage
Environment variables, secret files with restricted permissions, or a secrets manager — all require root-level control over your VPS.
Zero-Downtime Rotation
A well-designed rotation supports both old and new keys briefly, so the swap doesn't cause an outage mid-rotation.
Audit Trail
Logging when and why a key was rotated helps trace incidents back to a specific credential and timeframe later.
The Playbook, Step by Step
- Inventory every API key, database password, and third-party secret your application uses — check environment files, CI/CD config, and any hardcoded values you should have removed already.
- Classify by risk and blast radius — a payment gateway key matters more than a low-privilege internal service token, and should rotate more frequently or be watched more closely.
- Store secrets outside of source control — environment variables loaded at runtime, a .env file with restricted file permissions (chmod 600), or a dedicated secrets manager if your setup is complex enough to warrant one.
- Generate the new credential first, deploy it alongside the old one where the third-party service supports dual-active keys, confirm the application works with the new key, then revoke the old one.
- Automate what you can — a scheduled reminder (or script) that flags keys older than your rotation policy's threshold, so rotation doesn't rely purely on remembering.
Why root access on a VPS matters here
On shared hosting, you're often limited in how you can store secrets outside the application's own config files, and you may not control file permissions as granularly. A Linux VPS with root access lets you set exact file permissions on secret files, use systemd's EnvironmentFile directive to inject secrets at the process level, or run a self-hosted secrets tool if your setup needs one.
Applying This to Common Hoststack Setups
If you're running an API backend as described in our API backend hosting page, this rotation playbook applies directly to the environment variables or secret files your backend process reads at startup.
For CRM integration middleware (see our CRM integration hosting page), rotating OAuth tokens and API keys on a schedule is especially important since these often have broad access to customer data in the connected CRM.
Whatever your setup, avoid storing production secrets in your Hoststack client area notes or ticket history — use your application's own secret storage and treat support conversations as a place to discuss infrastructure, not to share live credentials.
FAQ
API key rotation questions
Get root access to manage your own secrets properly
Linux VPS from ₹399/mo — full control over environment variables, file permissions, and secret storage.
See Linux VPS Plans