# API key rotation

Canonical page: /glossary/api-key-rotation

API keys & secrets glossary, Keys & secrets. API Key Rotation: Why and How Often

**Short answer:** API key rotation is the practice of periodically replacing an active API key with a new one and revoking the old one, even when there is no known leak. It limits how much damage a key could do if it were compromised without your knowledge.

## Why it matters

Rotation only helps if updating every place the key is used is easy. If a key is scattered across several .env files and shell profiles, rotating it becomes a chore people put off.

## In Claude Keychain

Because Claude Keychain stores a key in exactly one place, rotating it means updating one entry, not hunting down every project's local copy of the old value.

## Common questions

**How often should I rotate an API key?**

There is no universal answer, but every 90 to 180 days is a common default for keys with real access.

**Does rotating a key break anything using the old one?**

Yes, briefly, anything still using the old key will fail until it picks up the new one, so rotate during low-usage windows when possible.

## Related

[Revoking an API key](/glossary/revoke-api-key), [API key](/glossary/api-key), [Principle of least privilege](/glossary/least-privilege)