Skip to main content
Rotate when a secret may have leaked. Revoke when an integration is retired or compromised.

​
Who this is for

Org admins who manage Integrations → API keys.

​
Rotate

Rotating regenerates the secret and typically the linked publishable key / client identifiers for that API client. Update every embed and server env after rotate.
1

Open the client

Integrations → API keys → select the client.
2

Rotate secret

Choose Rotate secret (or equivalent). Copy the new sk_* immediately — it is shown once.
3

Update deployments

  1. Put the new secret in your secrets manager
  2. Update browser embeds if the publishable key changed (pk_*)
  3. Redeploy servers that call partner APIs
  4. Confirm Sandbox test or production pages still load

​
API

​
Revoke

Revoking immediately blocks both the publishable and secret keys for that client.
1

Open the client

Integrations → API keys → select the client.
2

Revoke

Confirm Revoke. Create a replacement client before or after if the integration must keep running.

​
API

Revoke does not delete historical review data. It only stops that API client from authenticating.

​
One failure mode

Rotated key still in an old CDN / CMS cache — purge caches and update WordPress/Shopify theme settings so visitors stop sending the old pk_*.

​
Next

Create sandbox keys → · Authentication →