Skip to main content
Goal: Replace a Millwork API key without interrupting the application. You are done when: the application uses the new key and the old key returns 401.
Do not revoke the old key until the new key works. Never paste either key into support, source control, logs, or documentation.

1. Find the old key

Use the displayed prefix to identify the key. The full key is never returned by the list endpoint.

2. Create and test the replacement

The full replacement key appears once. Store it in the application’s secret manager, update the application, and confirm the application works.

3. Revoke the old key

Expected result: the old key is revoked. A request using it returns 401.

If it fails