Help Center/Authentication & API Keys

Rotating API keys without downtime

3 min read Updated October 22, 2026

Why rotate

Regular rotation limits the damage from a leaked key. Rotation keeps the old key valid for a grace period (24 hours by default) so you can switch services without downtime.

Rotate

In Dashboard → Developer → API Keys, or by API (authenticated with your developer session or a Bearer token):

bash

curl -X POST https://api.compliancegrid.ai/v1/developer/keys/KEY_ID/rotate \
  -H "Authorization: Bearer $CG_TOKEN" -H "Content-Type: application/json" \
  -d '{"gracePeriodHours": 24}'

The response contains the new key, shown once, with its keyId, keyPrefix and environment. The old key keeps working until the grace period ends. Rotating counts toward the limit of 2 active keys per environment.

Then

1. Deploy the new key to your services 2. Check usage under Dashboard → Developer → Usage 3. Revoke the old key once nothing uses it (it also stops on its own when the grace period ends):

bash

curl -X POST https://api.compliancegrid.ai/v1/developer/keys/OLD_KEY_ID/revoke \
  -H "Authorization: Bearer $CG_TOKEN"

A revoked key returns 401 invalid_api_key immediately.

Creating and listing keys by API

POST /v1/developer/keys with {"environment": "SANDBOX"} or {"environment": "PRODUCTION"} creates a key; GET /v1/developer/keys lists them.

Suggested schedule

Every 90 days for production keys and immediately if a key may be exposed.

Was this article helpful?