# Key Rotation

Rolling an API key without downtime requires a brief overlap window
where both the old and new key are valid.

## Steps

1. Create a new API key in the console. It is immediately active.
2. Update your agent's environment / config to use the new key for
   new requests. Old in-flight requests continue to use the old key.
3. Wait for all old-key requests to drain (no requests for ~5 minutes
   for chat, ~10 minutes for video - video tasks run long, but their
   later polls only need whichever key you configure).
4. Disable the old key in the console. Disabling takes effect on the
   next request - the key check re-reads key state from the database
   on every call, so there is no cache TTL to wait out. In-flight
   requests are not killed.
5. After 24 hours of no issues, delete the old key.

A disabled key gets 403 Forbidden, a deleted or unknown key gets 401
Unauthorized - distinguish them if your agent reports key state.

## Per-key rate limits and budgets

Each key has its own RPM rate limit and optional monthly budget. During
rotation, the new key starts with a fresh rate window (the sliding
window is tracked per key id) - useful for spike protection. The fresh
key also starts at zero monthly budget spend.

## Detection of compromised key

If you suspect a key is compromised, disable it immediately. The very
next request with that key is refused - enforcement is per-request,
not eventual.

## Auditing

The console's request log records every API call by key, filterable by
key in the Logs view. Use it to confirm old-key traffic has drained
before deleting the key, and to inspect what a suspected-compromised
key did.