Reissue API keys and tokens, service by service
When a key leaks or someone who saw it leaves, the fix is a new key from the provider that issued it. Each page says where to create the new key, whether the old one keeps working during the switch, how fast it stops, and what it could reach.
About these pages: 17 servicesSources last checked October 30, 2026
Services A to Z
17 services
One page per provider, with the dashboard link, the order of steps and what to check before you revoke the old key.
Across these services: Old and new keys work together: 17 of 17Revoked key stops at once: 13 of 17
Anthropic
Claude API key
Expiry: Chosen at creation: 3 hours to 30 days, custom or Never; fixed afterwards
sk-ant-api…Partly scopedAWS
IAM user access key
Expiry: None: a long-term credential until you deactivate or delete it
AKIA…Partly scopedDelayed revocationBitbucket
API token with scopes
Expiry: 1 to 365 days; one year by default
Scoped keys
Cloudflare
API token
Expiry: Optional TTL chosen when the token is created
cfut_…Scoped keysDigitalOcean
Personal access token
Expiry: Chosen at creation; an expired token disappears from the account
dop_v1_…Scoped keysDocker
Personal access token
Expiry: None by default; 30 or 90 days, or a custom date up to a year ahead
dckr_pat_…Partly scopedGitHub
Fine-grained personal access token
Expiry: Set at creation; no expiry is allowed unless an org lifetime policy blocks it
github_pat_…Scoped keysGitLab
Personal, project or group access token
Expiry: Required by default, at most 365 days unless an admin changes the limit
glpat-…Scoped keysGoogle Cloud
Service account key (JSON)
Expiry: Never by default; an organization policy can limit key lifetime
Partly scopedDelayed revocation
Hetzner
Cloud API token
Expiry: No expiry option in Hetzner's documentation
Partly scopedRevocation time unknown
npm
Granular access token
Expiry: Always set; write tokens default to 7 days and last at most 90
Scoped keysDelayed revocation
OpenAI
Project API key
Expiry: Optional at creation; admins can enforce a maximum lifetime
Scoped keys
Resend
API key
Expiry: None: a key stays valid until you delete it
re_…Partly scopedSendGrid
API key
Expiry: Not documented; treat the key as valid until you delete it
SG.…Scoped keysSSH
SSH key pair
Expiry: None for plain keys; expiry-time= or a certificate validity adds one
Partly scoped
Stripe
Secret API key
Expiry: Until you expire or rotate it
sk_live_…Partly scopedVercel
Access token
Expiry: Chosen at creation; the token stops working after that date
vcp_…Scoped keys
When someone leaves
A departure usually means several providers at once. Start with the order of work, then build the list for your own stack.
What Crunu does here
Crunu doesn't reissue keys at providers. It shows which values to replace and keeps the new one.
Guide
What to rotate when a developer leaves
When a developer leaves, access ends but the secrets they saw keep working. The order to work in, what to rotate first, and how to reissue without downtime.
Free tool
Offboarding checklist generator
Pick the services someone could reach and get an ordered checklist of what to close and which keys to reissue, with links.
How these pages are checked
Each page is checked against the provider's own documentation. The sources are listed at the end of the page, with the date we last checked each one.
Rotating keys in Crunu means changing the encryption keys of an environment. Reissuing means getting a new value from the provider, and that step is always yours.
If something is out of date or wrong, write to support@crunu.com.
Know which values to replace
Free during early access. When someone leaves, Crunu lists the values they received, changes the environment keys, and keeps each new value as a new version.