Cloud IAM Rotate an API Key
A 6-step recipe with IBM. We can help you get access.
Recipe · 6 steps
Cloud IAM Rotate an API Key
with IBM · Identity & Access Management
Create and verify a replacement API key, then unlock, disable, and delete the outgoing key.
- List the keys currently held by the identity so the rotation is performed against a known inventory and the outgoing key can be seen in context.
- Issue the replacement key for the same identity before anything is retired, so there is never a window without a working credential. The key value is returned only here.
- Confirm the replacement key authenticates by exchanging it for an access token. The outgoing key is only touched after this succeeds.
- Unlock the outgoing key so it can be modified and deleted. A locked key cannot be retired, and keys issued for production identities are commonly locked at creation.
- Disable the outgoing key so it immediately stops authenticating. This is the reversible checkpoint — if a forgotten consumer breaks, the key can be re-enabled rather than reissued.
- Permanently delete the outgoing key once the replacement is confirmed in service. This cannot be undone.
What you'll need to have ready
- accountId: The IBM Cloud account ID that owns the keys.
- iamId: The IAM ID the replacement key authenticates — the same identity as the outgoing key.
- outgoingApiKeyId: The unique identifier of the API key being retired.
- newApiKeyName: The name for the replacement API key.
- newApiKeyDescription: A description of the replacement key, typically recording the rotation date.
For your developer
Arazzo workflow ibm:rotate-api-key, 6 operations: listApiKeys → createApiKey → createAccessToken → unlockApiKey → disableApiKey → deleteApiKey. Specs on APIs.io.