API Key Rotation Planner

Credential rotation is one of those tasks everyone agrees is needed and nobody schedules. The result is the key created four years ago, present in three services, that nobody dares touch because it is no longer known who uses it. Setting the cadence and marking the dates is what turns this into predictable routine.

Enter the starting date, the interval and how many rotations to plan, and the page builds the list of dates. The usual interval runs from 90 days for high-risk credentials to a year for low-risk ones — and the criterion is not the calendar, it is the damage the key would do if leaked and the cost of replacing it.

What makes rotation work in practice is the overlap period. Swapping one key for another in a single instant breaks everything still using the old one; the safe route is issuing the new key, running both simultaneously, migrating consumers one at a time and only then revoking the old. Without that window, rotation turns into an incident — and after an incident nobody wants to rotate again.