# API key rotation breaks integrations: pre-release checklist

Source: https://releasefailures.com/incidents/api-key-rotation-breaks-integrations/
Content version: 1.0.0
Verified on: 2026-10-21
Licence: CC BY 4.0

Definition: A key rotation invalidates partner integrations that were not notified.
- [ ] PR-01 Run the key cleanup job against a test key store seeded with old keys, keys created that day and keys marked to retain, and confirm only the old keys are disabled. (test class: Integration tests)
- [ ] PR-02 Run the signing key removal automation in dry-run mode and confirm no key in a retain state appears on its removal list. (test class: Integration tests)
- [ ] PR-03 Rotate a signing key in a test environment and confirm a relying application that cached the previous metadata still validates tokens signed with a retained key. (test class: Integration tests)
- [ ] PR-04 Before a bulk key operation, compare the number of keys it will disable with the number of keys unused for the cleanup period and stop if they differ. (test class: Configuration and environment tests)
- [ ] PR-05 Confirm a point-in-time backup of the key table exists and a restore has been rehearsed before the cleanup runs. (test class: Configuration and environment tests)
- [ ] PR-06 During and after the cleanup, call the API every few minutes with a key created in the last 24 hours and alert on any authorization error. (test class: Synthetic monitoring)