# secrets-rotation

Source: https://startwithidentity.com/glossary/secrets-rotation/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

The practice of regularly changing credentials such as API keys, database passwords, and tokens to limit the window an exposed secret is useful. Dynamic secrets, issued short-lived and on demand, are the strongest form.

Rotation on a calendar is a weak control compared to rotation on an event, and both are weaker than not having a long-lived secret at all. The reason teams avoid rotating is unknown blast radius: nobody is certain what breaks. That uncertainty is itself the finding, and fixing it (ownership, references rather than copies, tested rotation) matters more than the interval you choose.

See also: [secrets management](https://startwithidentity.com/glossary/secrets-management/), [API key](https://startwithidentity.com/glossary/api-key/), [service account](https://startwithidentity.com/glossary/service-account/), [secrets vendors](https://startwithidentity.com/vendors/secrets/)