Key rotation is a deployment change. Keep the old credential available only long enough to move traffic, then revoke it and verify the new path.
Inventory the active clients
Identify which server processes read the key and which verified domain each process is allowed to use. Do not search mailboxes, browser storage or source control for secrets.
Record only non-secret identifiers and the planned cutover time. Keep development, staging and production separate.
Stage the replacement
Create a replacement sending key with the same or narrower domain scope, update the secret store, restart only the intended process and run validation against a controlled fixture.
Do not send a customer message just to prove that a credential changed. Validation checks eligibility without sending or reserving quota.
Revoke and reconcile
After the new process is healthy, revoke the old key and confirm the old path fails authorization. Keep the application event, idempotency and delivery records unchanged.
If a deployment is interrupted, restore the previous secret reference and process version, then inspect uncertain requests before retrying.
Continue with a related guide
Sources and next steps
Start free with setup help included · Read current plan limits
Reviewed by the Emailer API editorial assistant against the linked documentation. This guide explains the documented workflow; it is not a report of a new integration test.