> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getmillwork.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Replace a provider key

> Test a replacement before changing a working provider connection.

**Goal:** Replace a provider credential without discarding the current working
connection first.

**You are done when:** the connection is active, its test passed, and the
tested revision matches the new revision.

## 1. Complete a new secure setup

Start a new secure setup with the connection's existing `source_id` and
`auth_scheme`. Open its one-time browser URL and wait for the setup state to
become `completed`.

Follow [Connect a provider](/guides/connect-a-source) through the secure setup
steps, but do not create a second connection.

## 2. Rotate the connection

```bash theme={null}
if ! curl --fail-with-body \
  --request POST \
  --header "Authorization: Bearer $MILLWORK_API_KEY" \
  --header "Content-Type: application/json" \
  --data "{
    \"handoff_intent_id\": \"$SETUP_ID\"
  }" \
  --output rotated-connection.json \
  "$MILLWORK_API_URL/source-connections/$CONNECTION_ID/rotate"; then
  echo "The replacement failed. Read rotated-connection.json before retrying." >&2
  exit 1
fi

jq '{
  status,
  test_state,
  binding_revision,
  tested_binding_revision,
  rotated_at
}' rotated-connection.json
```

**Expected result:** `status` is `active`, `test_state` is `passed`, and both
revision numbers match.

## 3. Remove the old provider credential

Only after the new revision passes, remove or revoke the old credential in the
provider's controls.

## If it fails

If the replacement fails its test, Millwork keeps the current working
credential. Fix the replacement and start a new secure setup. Do not remove the
old provider credential yet.

Never send a provider key or one-time setup URL to support.