Secret rotation

비밀키 교체

Roll out a new key and retire the old one in a controlled sequence.

···
html
<div class="sd"><div class="sd-head"><strong>SECRET ROTATION</strong><span id="state">live check</span></div><div class="sd-stage"><div class="timeline"><div class="row"><span>KEY A</span><div class="track"><b id="old"></b></div></div><div class="row"><span>KEY B</span><div class="track"><b id="fresh"></b></div></div><div class="marker" id="marker"></div></div></div><div class="sd-foot"><span id="caption">checking boundary</span><span>tap to step</span></div></div>
css
.sd{box-sizing:border-box;width:min(94vw,700px);height:min(86vh,318px);padding:clamp(9px,2.3vmin,18px);border:1px solid var(--line);border-radius:14px;background:var(--surface);color:var(--fg);display:flex;flex-direction:column;gap:clamp(6px,1.8vmin,12px);font:600 clamp(12px,2.6vmin,16px)/1.25 var(--font-sans, sans-serif)}.sd *{box-sizing:border-box}.sd-head,.sd-foot{display:flex;align-items:center;justify-content:space-between;gap:8px;min-height:1.25em}.sd-head strong{color:var(--accent);letter-spacing:.06em}.sd-head span,.sd-foot{color:var(--muted)}.sd-foot{font-size:clamp(12px,2.4vmin,14px)}.sd-stage{position:relative;flex:1;min-height:0;display:flex;align-items:center;justify-content:center;gap:clamp(6px,2vmin,18px);overflow:hidden}.sd .mono{font-family:ui-monospace,monospace}.sd .tile{border:1px solid var(--line);border-radius:8px;background:var(--bg);padding:clamp(5px,1.5vmin,10px);text-align:center}.sd .good{color:var(--accent);border-color:var(--accent)}.sd .bad{color:var(--accent-3);border-color:var(--accent-3)}.sd .arrow{color:var(--muted);font-size:clamp(15px,4vmin,28px)}.sd .active{background:color-mix(in srgb,var(--accent) 16%,var(--surface));border-color:var(--accent)}.sd .blocked{background:color-mix(in srgb,var(--accent-3) 13%,var(--surface));border-color:var(--accent-3)}.timeline{position:relative;width:min(96%,500px);display:grid;gap:clamp(8px,3vmin,20px)}.row{display:flex;align-items:center;gap:8px;font-family:ui-monospace,monospace}.row span{width:54px}.track{flex:1;height:clamp(14px,4vmin,24px);border-radius:5px;background:var(--bg);overflow:hidden}.track b{display:block;height:100%;transition:width .4s}.row:first-child b{background:var(--accent-2)}.row:nth-child(2) b{background:var(--accent)}.marker{position:absolute;left:60%;top:0;bottom:0;border-left:2px dashed var(--fg);transition:left .4s}
js
let n=0;function advance(){n=(n+1)%3;document.getElementById('old').style.width=n===2?'0%':'100%';document.getElementById('fresh').style.width=n===0?'0%':'100%';document.getElementById('marker').style.left=['20%','60%','90%'][n];document.getElementById('state').textContent=['old only','overlap','new only'][n];document.getElementById('caption').textContent=['issue new key','both keys accepted','revoke old key'][n]}advance();setInterval(advance,850);
document.querySelector('.sd').addEventListener('pointerdown',advance);

Secret rotation replaces an API key or signing key with a new value. Deploy the new key to consumers, accept both during a short overlap, and then revoke the old one to avoid downtime.

The timeline highlights the overlap. Keeping the old key forever defeats the rotation, so inventory consumers and set a clear retirement time.

When to use

Use it for scheduled rotation, incident response, and changes to service credentials.

Open as page ↗