Rotating an API key replaces the key for an existing app while keeping the app itself unchanged. Rotate your API key immediately if it was leaked or might have been exposed, and rotate keys periodically as part of your security process.
You must be a team admin to rotate API keys. If you don't have permission, contact your team admin.
Rotating a key affects every service, script, and environment that uses the current key for the app.
Before starting, identify where the current key is used, such as:
- backend environment variables
- frontend or mobile app configuration
- serverless functions and CI/CD secrets
- monitoring, indexing, or data pipeline jobs
- local development configuration
The previous key stops working within 2 minutes after rotation. Update every integration that depends on the key immediately.
Go to the Alchemy Dashboard, then select the app whose API key you want to rotate.
Open the App Settings tab.
If you don't see the Rotate API key section, API key rotation might not be enabled for your team yet.
In the Rotate API key section, click Rotate API key.
Review the warning, then click Rotate API key again to confirm.
This action can't be undone. The app's settings, history, and usage data are unaffected, but the previous key stops working within 2 minutes.
Copy the new API key and update every integration that used the previous key.
After replacing the key in your integrations:
- make a test request with the new key
- remove the previous key from secrets managers, CI/CD settings, and local configuration
- redeploy or restart services that read the key at startup
- review recent requests and errors to confirm traffic is using the new key
API key rotations are recorded in the Dashboard activity log as API key rotated.
- Send API keys in HTTP headers to keep keys out of request URLs.
- Add allowlists to your apps to restrict where the key can be used.
- Review key security best practices.