# API key rotation breaks integrations: first 30 minutes checklist

Source: https://releasefailures.com/incidents/api-key-rotation-breaks-integrations/
Content version: 1.0.0
Verified on: 2026-10-21
Licence: CC BY 4.0

Definition: A key rotation invalidates partner integrations that were not notified.
- [ ] FM-01 Check whether authorization errors are limited to API key or token traffic while the UI works.
- [ ] FM-02 List every key cleanup, rotation or removal job that ran before the errors began, including automated jobs outside the deploy pipeline.
- [ ] FM-03 Stop the running key job and freeze further bulk key operations.
- [ ] FM-04 Decide between restoring the affected keys from a point-in-time backup and asking customers to create new keys; a restore keeps integrations working without customer action.
- [ ] FM-05 For a removed signing key, roll back the published key metadata and invalidate caches that hold the changed metadata.
- [ ] FM-06 Post a status update that names the affected key types, states that the UI still works, and gives the new-key workaround.
- [ ] FM-07 Tell integration owners whether they must restart services to pick up new tokens and key metadata.