# How do I rotate or revoke API keys?

> In the dashboard, go to API keys, generate a new key, deploy it to your applications, then revoke the old key. Revocation is instant, and keys are never logged, so a rotated key stops working immediately with no residual exposure. Rotate on a schedule (for example quarterly) and immediately after any suspected exposure, and treat the token from your test credentials as a production secret: it calls the production endpoint. See /developers/authentication.

- Canonical URL: https://www.broadnet.me/answers/rotate-api-keys
- Language: en
- Last reviewed: 2026-09-29
- Publisher: BroadNet (https://www.broadnet.me)

## Rotate without downtime

Generate a new key in the dashboard (API keys → generate) while the current key is still active. Deploy the new key to your applications and confirm traffic is flowing on it, then revoke the old key. Because both keys are valid during the overlap window, there is no gap in service — this is the standard zero-downtime rotation pattern.

## Revoking a key

Revoking a key in the dashboard takes effect immediately: any request presenting the revoked key is rejected. Because BroadNet never logs raw keys, a revoked key leaves nothing behind to leak. Revoke immediately if a key may have been committed to source control, pasted into a ticket, or otherwise exposed.

## Treat test credentials as production secrets

Test credentials work against the production endpoint, https://api.broadnet.me, so protect them like any production secret from day one: keep the token in an environment variable or a secrets manager, never in source control, client-side code or shared test fixtures, and rotate it if it may have been exposed. See /answers/what-is-sandbox-vs-production.

## When to rotate

Rotate on a fixed schedule (quarterly is a common baseline) so no single key lives indefinitely, and rotate immediately on any suspected exposure or when someone with access to a key leaves the team. Scheduled rotation limits the blast radius of a key you didn't know was compromised.

## Keys are revocable

API keys are revocable at any time, which is what makes routine rotation safe and cheap. Combine rotation with least-privilege key usage so each application only holds the credentials it actually needs. See /developers/authentication.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [Test credentials vs production: what changes when you go live?](https://www.broadnet.me/answers/what-is-sandbox-vs-production)
- [How do I activate my BroadNet account?](https://www.broadnet.me/answers/activate-account)
- [What is an SMS API?](https://www.broadnet.me/answers/what-is-sms-api)
- [Authentication](https://www.broadnet.me/developers/authentication)
- [Developer docs](https://www.broadnet.me/developers)