Credential Rotation

Credential rotation replaces an existing secret used to authenticate a person, service, or application with a new one. Common targets include API keys, database passwords, service-account credentials, signing keys, and deployment tokens. The goal is to reduce the time a leaked or obsolete secret can be used and to keep access under deliberate control. Rotation includes more than generating a new string: every authorized consumer must be updated and the old value must be retired.

A careful process identifies where a credential is used, creates a replacement with appropriate permissions, distributes it through a secrets manager or another secure channel, tests dependent systems, and revokes the previous credential. Some systems support overlapping credentials for a short transition; others require tightly coordinated replacement to avoid downtime. Logging and incident response need to confirm that the old value no longer works. Secrets should never be placed in public repositories or diagnostic logs.

Not every credential should follow the same calendar. OWASP's secrets-management guidance discusses automated rotation of application secrets and shorter-lived credentials. NIST SP 800-63B explicitly says centrally verified user passwords should not be subject to arbitrary periodic changes, although a change is required when there is evidence of compromise. Therefore 'rotate credentials every 30 days' is not a universal user-password rule. Businesses should distinguish application secrets from human sign-in passwords and set controls based on actual system risk.