Rotate and Retire Keys Without Surprises

• A list of what can be rotated and how
• A calendar routine for each
• An incident order for a suspected leak
• A quarterly review

1. 1

   Create the replacement at the provider

   Keep the old key live.

2. 2

   Choose Rotate in Cloptima

   Enter the replacement key.

3. 3

   Test

   Confirm the credential passes.

4. 4

   Delete the old key at the provider

   Last.

For a key that must never fail, create a second key with the same labels, move the app to it, then revoke the first. There is no gap that way.

1. 1

   Create the new key or register the edge again

   Copy the new secret or token.

2. 2

   Switch the SDK or the edge to it

   Redeploy.

3. 3

   Check that data flows

   Usage events and heartbeats arrive.

4. 4

   Revoke the old one

   It stops working at once.

1. 1

   Revoke the exposed virtual key

   Requests with it stop at once.

2. 2

   Rotate or revoke the provider credential if it was exposed

   Revoke makes bound requests fail, so you notice.

3. 3

   Revoke the telemetry key or edge token if exposed

   Then replace them.

4. 4

   Check the Explorer for the key

   Group by Virtual Key and look at the hours around the exposure.

5. 5

   Open the Audit tab

   Review changes made around the same time.

6. 6

   Replace and redeploy

   Create the new key with the same labels.

The console starts virtual keys at 3,650 days. Choose a shorter lifetime when you create the key.

resource "cloptima_llm_virtual_key" "support_chatbot" {
  name            = "support-chatbot-prod"
  expires_in_days = 180
  team_id         = "support"
  app_id          = "support-chatbot"
  environment     = "production"

  lifecycle {
    create_before_destroy = true
  }
}

create_before_destroy issues the new key first, so you can store its secret and deploy before the old one is retired. The secret is a sensitive output; write it to your secret manager and nowhere else.

1. 1

   List active keys

   Open each card and read the last-used time.

2. 2

   Revoke the unused

   Anything with no recent use is a risk.

3. 3

   Check labels

   Every key has a team and an app.

4. 4

   Retest credentials

   Use Test All.