Operations BroadNet answer

How do I rotate or revoke API keys?

Last reviewed September 29, 20261 min readReviewed by BroadNet engineering

Quick answer

In the dashboard, go to API keys, generate a new key, deploy it to your applications, then revoke the old key. Revocation is instant, and keys are never logged, so a rotated key stops working immediately with no residual exposure. Rotate on a schedule (for example quarterly) and immediately after any suspected exposure, and treat the token from your test credentials as a production secret: it calls the production endpoint. See /developers/authentication.

Plain-language definitionVendor-neutralReviewed September 29, 2026

The long answer

Everything worth knowing, nothing that isn't.

§01

Rotate without downtime

Generate a new key in the dashboard (API keys → generate) while the current key is still active. Deploy the new key to your applications and confirm traffic is flowing on it, then revoke the old key. Because both keys are valid during the overlap window, there is no gap in service — this is the standard zero-downtime rotation pattern.

§02

Revoking a key

Revoking a key in the dashboard takes effect immediately: any request presenting the revoked key is rejected. Because BroadNet never logs raw keys, a revoked key leaves nothing behind to leak. Revoke immediately if a key may have been committed to source control, pasted into a ticket, or otherwise exposed.

§03

Treat test credentials as production secrets

Test credentials work against the production endpoint, https://api.broadnet.me, so protect them like any production secret from day one: keep the token in an environment variable or a secrets manager, never in source control, client-side code or shared test fixtures, and rotate it if it may have been exposed. See /answers/what-is-sandbox-vs-production.

§04

When to rotate

Rotate on a fixed schedule (quarterly is a common baseline) so no single key lives indefinitely, and rotate immediately on any suspected exposure or when someone with access to a key leaves the team. Scheduled rotation limits the blast radius of a key you didn't know was compromised.

§05

Keys are revocable

API keys are revocable at any time, which is what makes routine rotation safe and cheap. Combine rotation with least-privilege key usage so each application only holds the credentials it actually needs. See /developers/authentication.

BNWritten by the BroadNet engineering team·Operating carrier-grade messaging since 2003, headquartered in Dubai·Editorial standards

Build with this

Need help wiring this up?

The pages below are the products and integration guides that put this concept on the wire. If you'd rather walk through it live, our engineering team takes calls same-day during MENA working hours.

Talk to our engineering team

Feedback

Was this answer helpful?

Your vote helps us prioritise which answers to expand with examples, diagrams, and code snippets.

Yes No

Thanks — noted. We'll keep this answer maintained.

Got it. Tell us what was missing — send a quick note.

How we write and review content

Talk to a real engineer about your build.

We reply within one business day, and production accounts get 24/7 support. Our solutions engineers ship code, not scripts.

Talk to support Speak with sales

$ curl -X POST https://api.broadnet.me/sms/sendSms

Response SLA

Test-access requestsReply within 1 business day

Production24 / 7 · < 15 min

Operator NOC24 / 7 · pager

support@broadnet.me · +971 4 456 7768