Rotating an API key is a routine security practice, but doing it without downtime requires both the old and new key to work simultaneously while dependent systems update. TigerTrust handles this with a configurable grace window — the old key stays active for up to 30 days after rotation so you can migrate consumers on your own schedule.

​
What it is

When you rotate a key, TigerTrust creates a successor key and optionally keeps the old key valid for a grace period you specify. During the grace window both keys authenticate successfully. After the window closes, the old key stops working automatically. The new key’s full value is displayed exactly once in a modal — copy it immediately, because it cannot be retrieved again.

​
When to use it

  • Respond to a suspected credential leak by rotating immediately with a zero-day grace window.
  • Perform a planned credential rotation for compliance without coordinating a maintenance window.
  • Rotate CI/CD pipeline keys quarterly by setting a 7-day grace so pipelines can pull the new key from your secrets manager before the old one expires.
  • Hand off a workspace to a new team and replace all existing keys as part of the transition.

​
Set it up

1

Open API Keys

Go to Settings > API Keys. All active keys are listed with their prefix and last-used date.
2

Start rotation

Click Rotate next to the key you want to replace. The rotation dialog opens.
3

Set the grace period

Choose how many days (0 to 30) the old key should remain active. Set 0 to revoke the old key immediately.
4

Copy the new key

After clicking Confirm, a reveal-once modal displays the full new key value. Click Copy and store it securely — TigerTrust will never show the full value again. Only the key prefix is visible after you close this modal.
5

Update your consumers

Replace the old key in your applications, CI pipelines, or agents before the grace period ends.

​
What you’ll see

The key list shows both the old and new keys during the grace period. The old key is labelled (rotated) with a badge showing the grace expiry date. After the grace period, the old key row shows Expired and stops accepting requests. Both entries remain visible in the list for audit traceability.
A key that has already been rotated cannot be rotated again. If you need another rotation, rotate the new successor key instead.

​
Tips

  • If you do not supply a name during rotation, the old key is automatically renamed to <original name> (rotated) so the pair is easy to identify.
  • Revocation events appear in Audit Logs so you can confirm when each key was invalidated.
  • You can also interact with key management via the API — full spec at API Reference.

Managed Accounts

Issue separate keys for each child workspace in a reseller setup.