> ## Documentation Index > Fetch the complete documentation index at: https://docs.fluz.app/llms.txt > Use this file to discover all available pages before exploring further. # Rotate your API credentials > Replace your application's API key and secrets on a schedule, when someone leaves, or right away if you think they were exposed. Rotating a credential replaces it with a new one and turns the old one off. You do this yourself, in the developer dashboard. > [!NOTE] > > **Fluz can't rotate your keys for you.** Fluz staff can't see your API key or secrets. That's by design. Only people with access to your developer account can view or change them. *** ## When to rotate | Situation | When | | :- | :- | | You think a credential was exposed (committed to a repo, pasted in a ticket or chat, printed in logs, or on a server or admin tool someone got into) | **Now.** Don't wait for a maintenance window. | | Someone with access to the credential leaves your team | As part of offboarding | | Routine hygiene | On a regular schedule you set | *** ## What you can rotate All of these live on the **Overview** tab of your app. | Credential | Rotate it? | What breaks until you update it | | :- | :- | :- | | **API Key** / **API Secret** | Yes | Every `generateUserAccessToken` call made with `Authorization: Basic `, and any widget transaction tokens you sign with the API Secret | | **Client Secret** (OAuth apps) | Yes | Code exchange and token refresh calls that use `Authorization: Basic base64(client_id:client_secret)` | | **Client ID** | No | It's public by design. Nothing to rotate. | Your API Key is a base64-encoded `app_id:app_secret` pair. When the secret changes, the key changes with it. Copy the new key whole from the dashboard. Don't rebuild it yourself. *** ## Before you start > [!WARNING] > > **The old credential stops working the moment you regenerate it.** There is no overlap period where both work. Any service still holding the old value starts getting `401` errors right away. So line these up first: * **Know everywhere the credential lives.** Secret manager, environment variables, CI/CD, every service or job that calls Fluz. * **Have a fast way to push the new value.** Ideally you update one secret in your secret manager and restart or redeploy. * **Try it in staging first.** Staging and live have separate apps and separate credentials, so rotating in staging is a safe dry run. *** ## Rotate a credential **1. Open the developer dashboard for the right environment** Live: `https://fluz.app/for-developers`. For staging, use the **Open Staging** link on the developer tab. Your login is the same in both, but each one only shows its own apps and keys. **2. Open your app** Select it from **Your apps**, or go straight to `https://fluz.app/for-developers/overview/{appId}`. **3. Regenerate the credential on the Overview tab** Regenerate the API Key / API Secret, the Client Secret, or both. Copy each new value straight into your secret manager. Don't paste it into chat, email or a ticket. **4. Update every service and redeploy** Push the new value everywhere you listed above, then restart or redeploy so nothing is still holding the old one in memory. **5. Mint fresh access tokens** Call `generateUserAccessToken` with the new API Key. Stop using tokens you minted before the rotation and replace them with new ones. **6. Confirm the old credential is dead** A request with the new key should succeed. A request with the old key should return: ```json theme={null} { "error": "Error verifying API basic token" } ``` **7. Repeat in the other environment if needed** Rotating in live does nothing to staging, and the other way around. *** ## If you think a credential was exposed 1. **Rotate right away** in the affected environment, using the steps above. 2. **Need to stop all API traffic immediately?** Disable the app from the dashboard. Calls made with its credentials will return `403` until you turn it back on. 3. **Check your app settings on the OAuth tab.** Confirm your redirect URIs and webhook URLs are the ones you set, and remove anything you don't recognize. 4. **Review recent activity** on your Fluz account and confirm it matches what your systems did. 5. **Tell your Fluz representative** if you see anything you can't account for. *** ## Troubleshooting | Symptom | Almost always | | :- | :- | | `401` with `Error verifying API basic token` right after rotating | A service is still using the old key. Find it and update it. | | Live works, staging returns `401` (or the reverse) | Staging and live have separate credentials. You rotated one and are calling the other. | | `403` with `Application is not in a valid status` | The app is disabled. Re-enable it in the dashboard. | | OAuth code exchange or token refresh fails after rotating | That service is still using the old Client Secret. | | Widget transactions fail after rotating | You're still signing tokens with the old API Secret. | *** ## Related > [card] [API credentials](https://docs.fluz.app/get-started/api-credentials.md) > > Where your credentials live and how to mint access tokens. > [card] [Security & compliance](https://docs.fluz.app/developers/security.md) > > Your responsibilities for keeping secrets safe. > [card] [Configure OAuth app](https://docs.fluz.app/create-an-o-auth-app.md) > > The Overview, Permissions and OAuth tabs. > [card] [Deploy to production](https://docs.fluz.app/deploying-to-production.md) > > Staging and live are separate apps with separate keys. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.