# Replace a key

Swap a credential without downtime, before it expires or after it leaks.

Keys aren't rotated in place: you create the new one, move your integration to it, then revoke the old one. Owners are emailed 14 and 3 days before an organization key expires, so there's time to do this calmly.

<Steps>

<Step title="Create the new key">

In **Settings › API keys**, create a key with the same permissions as the old one.

</Step>

<Step title="Deploy it">

Put the new key in your integration's secret store and redeploy. Both keys work at the same time, so nothing fails in between.

</Step>

<Step title="Revoke the old key">

Once your integration runs on the new key, revoke the old one. It stops working on the next request.

</Step>

</Steps>

<Note title="If a key leaked" tone="warning">
  Revoke it first, then create the replacement. A few minutes of downtime is better than someone else using your organization's data.
</Note>