# Rotate your API key without downtime

When you regenerate your Apideck API key, you can keep the current key valid for a grace period. Your old and new keys both work during that window, so you can deploy the new key, check production, and then revoke the old one yourself.

- [How the grace period works](#how-the-grace-period-works)
- [Rotate your key](#rotate-your-key)
- [Webhook signatures during a rotation](#webhook-signatures-during-a-rotation)
- [Rotating after a leak](#rotating-after-a-leak)

## How the grace period works

Your application has one API key. When you regenerate it with a grace period, the new key becomes your API key and the old key stays valid until the grace period ends. Both keys authenticate requests for the same App ID and the same consumers.

| Grace period | What happens to the current key |
| --- | --- |
| Immediately | Stops working as soon as the new key is generated |
| 1 hour | Keeps working for 1 hour |
| 24 hours | Keeps working for 24 hours |
| 7 days | Keeps working for 7 days |

You can end the grace period early with **Revoke now**. If you regenerate again while an earlier key is still in its grace period, that earlier key keeps working until its own grace period ends or until you revoke previous keys.

## Rotate your key

1. Open [API Keys](https://platform.apideck.com/configuration/api-keys) in the Apideck dashboard and select **Regenerate Key**. Only admins and owners can regenerate keys.
2. Under **Keep the current key valid**, choose how long your current key stays valid. Pick a window longer than your deploy and smoke test take.

   ![Regenerate API key dialog with the grace period options Immediately, 1 hour, 24 hours and 7 days](/guides/api-key-rotation/regenerate-grace-period.png)

3. Confirm. The dashboard shows the new API key, and below it the time until which the previous key stays valid.
4. Update the key wherever you store it (secrets manager, environment variables) and deploy.
5. Check that production traffic succeeds with the new key.
6. Select **Revoke now** to stop the previous key at once, or let the grace period run out.

> **Revoke now stops every previous key**
>
> It applies to all previous keys still in their grace period. Any system still sending an old key gets a 401 Unauthorized response from that moment.

## Webhook signatures during a rotation

Apideck signs webhooks with your API key (see [webhook signature verification](/guides/webhook-signature-verification)). Signing switches to the new key as soon as you regenerate it, even while the old key is still valid for API requests.

If the service that verifies webhook signatures is deployed separately from the service that calls the API, update its key first, or verify against both the new and the old key until the rotation is done. Otherwise webhooks fail signature checks between the regeneration and that deploy.

## Rotating after a leak

If the current key is exposed, choose a short grace period, or **Immediately** if you can accept a few minutes of failed requests. Revoke the old key as soon as your deploy finishes. A leaked key keeps working for the whole grace period, so a 7-day window only suits planned rotations.