Goal: Replace a Millwork API key without interrupting the application.
You are done when: the application uses the new key and the old key returns
401.
Do not revoke the old key until the new key works. Never paste either key
into support, source control, logs, or documentation.
1. Find the old key
Use the displayed prefix to identify the key. The full key is never returned
by the list endpoint.
2. Create and test the replacement
The full replacement key appears once. Store it in the application’s secret
manager, update the application, and confirm the application works.
3. Revoke the old key
Expected result: the old key is revoked. A request using it returns 401.
If it fails