What is credential reissue? Rotate vs reissue

Credential reissue is replacing a secret at the service that issued it: the provider creates a new API key, password or token, you deploy the new value everywhere it is used, and the provider then revokes the old one so that any copy of it stops working.

Rotate or reissue

Both are often called "rotation", and mixing them up leads to false confidence. Crunu uses two words on purpose:

• Rotate means replacing a cryptographic key that protects data, such as the key that encrypts an environment in a vault. It protects what is encrypted from now on. See key rotation.
• Reissue means replacing the secret itself at its provider: a new Stripe key, a new AWS access key, a new database password.

They answer different threats. If someone saw your Stripe key, rotating the vault's encryption key keeps them from reading the next version stored in the vault. It does nothing about the Stripe key they already have; Stripe will keep accepting it until it is revoked at Stripe. Only reissuing closes that gap.

How reissue usually goes

1. Create the new value at the provider. Many providers allow two valid credentials at once. AWS lets an IAM user have a second access key "while the first access key is still active" (AWS).
2. Deploy it to every service and pipeline that uses the old one.
3. Confirm the old one is idle. AWS suggests reviewing its Last used information, and Stripe its request logs (Stripe).
4. Revoke the old value. AWS recommends deactivating first and deleting later, so a missed application can be found and fixed.

The time when both values work is the key overlap window. Without one, reissue means a short planned outage.

When to reissue

• Someone who could read the value leaves or changes roles. Stripe lists this case among its reasons to rotate a key.
• The value leaked, or might have.
• Your policy says so, on a schedule.

Common mistakes

• Reissuing before cutting access. If the departing person can still read the vault, they read the new value too.
• Missing one consumer. Revoke the old value while one cron job still uses it, and that job fails; the temptation is to re-enable the old value and forget.
• Calling a vault rotation "done". New encryption keys are good. The old provider value is still live.

What Crunu does and doesn't do

Crunu doesn't reissue anything at providers. It has no access to your AWS, Stripe or GitHub account and can't create or revoke keys there.

It does three things around the reissue:

• Rotates its own keys when access changes: removing a member rotates the key of every environment they could read.
• Lists what to reissue. The member removal wizard ends with a reissue checklist: values the person received that are still in use, with a Where to reissue link for known services. Values are never shown, only file paths and names.
• Delivers the new value. Save it as a new version, and services started with crunu run --restart on-change restart with it.

Prioritizing a long list, and the order of steps on someone's last day, is in what to rotate when a developer leaves. Provider-by-provider steps are in the rotation guides.

Sources

• AWS IAM: Update access keys, checked October 30, 2026.
• Stripe Docs: API keys, checked October 30, 2026.