Skip to main content
Rotating a credential replaces it with a new one and turns the old one off. You do this yourself, in the developer dashboard.
Fluz can’t rotate your keys for you. Fluz staff can’t see your API key or secrets. That’s by design. Only people with access to your developer account can view or change them.

​
When to rotate

​
What you can rotate

All of these live on the Overview tab of your app. Your API Key is a base64-encoded app_id:app_secret pair. When the secret changes, the key changes with it. Copy the new key whole from the dashboard. Don’t rebuild it yourself.

​
Before you start

The old credential stops working the moment you regenerate it. There is no overlap period where both work. Any service still holding the old value starts getting 401 errors right away.
So line these up first:
  • Know everywhere the credential lives. Secret manager, environment variables, CI/CD, every service or job that calls Fluz.
  • Have a fast way to push the new value. Ideally you update one secret in your secret manager and restart or redeploy.
  • Try it in staging first. Staging and live have separate apps and separate credentials, so rotating in staging is a safe dry run.

​
Rotate a credential

1

Open the developer dashboard for the right environment

Live: https://fluz.app/for-developers. For staging, use the Open Staging link on the developer tab. Your login is the same in both, but each one only shows its own apps and keys.
2

Open your app

Select it from Your apps, or go straight to https://fluz.app/for-developers/overview/{appId}.
3

Regenerate the credential on the Overview tab

Regenerate the API Key / API Secret, the Client Secret, or both. Copy each new value straight into your secret manager. Don’t paste it into chat, email or a ticket.
4

Update every service and redeploy

Push the new value everywhere you listed above, then restart or redeploy so nothing is still holding the old one in memory.
5

Mint fresh access tokens

Call generateUserAccessToken with the new API Key. Stop using tokens you minted before the rotation and replace them with new ones.
6

Confirm the old credential is dead

A request with the new key should succeed. A request with the old key should return:
7

Repeat in the other environment if needed

Rotating in live does nothing to staging, and the other way around.

​
If you think a credential was exposed

  1. Rotate right away in the affected environment, using the steps above.
  2. Need to stop all API traffic immediately? Disable the app from the dashboard. Calls made with its credentials will return 403 until you turn it back on.
  3. Check your app settings on the OAuth tab. Confirm your redirect URIs and webhook URLs are the ones you set, and remove anything you don’t recognize.
  4. Review recent activity on your Fluz account and confirm it matches what your systems did.
  5. Tell your Fluz representative if you see anything you can’t account for.

​
Troubleshooting

API credentials

Where your credentials live and how to mint access tokens.

Security & compliance

Your responsibilities for keeping secrets safe.

Configure OAuth app

The Overview, Permissions and OAuth tabs.

Deploy to production

Staging and live are separate apps with separate keys.