Inventory the credential and blast radius

Record owner, provider/service, environment, scopes, tenant/account, creation/expiry, secret-manager path, every consumer/deployment, network restrictions, last-use telemetry, and revocation method. Do not copy the secret value into the rotation ticket.

Identify hidden consumers: queue workers, schedulers, CLI jobs, CI/CD, disaster-recovery environments, old mobile builds, and manual support scripts. Remove obsolete consumers instead of preserving broad access forever.

Create the replacement

Prefer short-lived or dynamically issued credentials when the provider supports them. Otherwise generate a cryptographically strong key with minimum scopes, explicit purpose, expiry, and environment isolation. Store it directly in the approved secret manager and audit who can retrieve or update it.

Test the credential against a non-destructive health/read operation where available. Do not display it after initial creation or place it in shell history, chat, logs, source, or deployment output.

Deploy with controlled overlap

Update consumers in a staged order. Ensure processes reload secrets correctly; a changed secret store does not guarantee long-running workers picked up the value. Verify successful calls by credential identifier or version—not plaintext—and watch authorization errors, rate limits, and unexpected source locations.

Keep the old credential enabled only for a documented overlap and rollback. A rollback should redeploy the prior secret reference, not paste the old value into configuration manually.

Revoke and test failure

After all consumers use the replacement, revoke the old credential at the provider. Confirm a controlled request with the old identifier fails and normal production remains healthy. Removing a secret from the manager without provider revocation does not invalidate a stolen copy.

Search code/logs/artifacts for accidental exposure and follow incident procedures if found. Rotation is not a substitute for containment when compromise is suspected; revoke faster and use emergency access controls.

Close the record

Store approver, new credential ID/purpose/scopes/expiry, consumers updated, verification, old ID and revocation time, incidents, and next rotation. The process succeeds when access is narrower, every consumer is proven, and the previous key is unusable—not simply when a new key exists.