Rotate an API key without touching every machine

Why rotation matters

Keys leak in ways you never notice. Rotating on a schedule — and immediately after any suspected leak — turns a leaked key into a short-lived inconvenience instead of a breach.

Rotate at the provider

1. Create a new key at the provider.
2. Copy it once.
3. Do not delete the old key until the new one is confirmed working.

Update the vault

1. In the console, open Settings → API keys.
2. Paste the new key over the old one.
3. Save. The vault now uses the new key.
4. Delete the old key at the provider.

Why devices need no change

Devices hold tokens, not keys. When the vault key changes, the next request simply uses the new one — there is nothing to edit on any machine.

Test after rotating

$ remoteagent chat "ping"