Rotation
The planned replacement of an active credential with a new one, followed by updating consumers and retiring the old value.
What it is
Credential rotation changes the value used for access while preserving the service's intended function. A safe rotation creates or enables the replacement, updates every authorized consumer, verifies the new value, and then revokes the old one. Rotation limits how long a leaked or overexposed credential remains useful.
How it relates to Orbit
Orbit tracks credential rotation separately when a Security finding exposed a secret. See /docs/concepts/security/ for details.
When you would use it
You rotate a credential when its exposure, age, ownership, or policy requires a fresh value without leaving an avoidable access gap.
Common operations
- Replacing API keys and personal access tokens on a schedule or after an exposure.
- Coordinating a replacement so dependent services switch before the old credential is disabled.