API keys & rotation
2 min readUpdated July 2026
Tidbit API keys are the credential your client sends to the gateway as x-api-key. Manage them under API Keys in the console; the Get set up pane can also mint and revoke them.
Rotate a key#
Rotate swaps the key’s secret in place: a new secret is issued and shown once, and the old secret stops working immediately. Use it when a secret may have leaked and you want it dead right now.
Zero-downtime rollover#
For a swap with no downtime, create a second key, deploy its secret to your clients, and revoke the old key once nothing is using it.
Rotate and revoke both cut off the old secret immediately. If uptime matters, roll over with a second key instead of rotating in place.