Secrets Rotation
The practice of regularly changing credentials such as API keys, database passwords, and tokens to limit the window an exposed secret is useful. Dynamic secrets, issued short-lived and on demand, are the strongest form.
Rotation on a calendar is a weak control compared to rotation on an event, and both are weaker than not having a long-lived secret at all. The reason teams avoid rotating is unknown blast radius: nobody is certain what breaks. That uncertainty is itself the finding, and fixing it (ownership, references rather than copies, tested rotation) matters more than the interval you choose.
See also: secrets management, API key, service account, secrets vendors
Related on Start with Identity
- GlossaryNon-Human Identity (NHI)
Any identity that is not a person: service accounts, API keys, OAuth tokens, certificates, workloads, and AI agents. NHIs now outnumber human identities in most
- GlossaryLLMjacking
LLMjacking is the use of stolen credentials to consume, resell, or abuse someone else's access to a large language model, usually through a cloud account or an
- GlossaryBreak-Glass Account
A tightly controlled emergency account used only when normal access fails, with strong vaulting, monitoring, and alerting. Tested regularly so it works in a rea
- Vendor1Password Secrets Automation
strong
- GuideAPI Key Rotation Automation Guide
A practical guide to automating API key rotation with zero downtime, covering rotation strategies, secrets management integration, dual-key patterns, monitoring
- VendorAWS Secrets Manager
strong