ToolypetMCP
intermediate3 minutescross hub

API Key Rotation Workflow

Generate new API keys, create HMAC signatures for validation, and hash old keys for audit logging.

api-keyrotationhmacsecurity

何时使用此配方

Structured API key rotation with audit trail. Ensures new keys work before decommissioning old ones, and maintains security logs without storing raw secrets.

步骤

1

Secret Generator

试用此工具

Generate new API key

提示词:Generate a new 512-bit API key in base64 format for rotation
2

HMAC Generator

试用此工具

Validate new key with HMAC

提示词:Create HMAC-SHA256 signature of a test payload using the new key to verify it works
3

Hash Calculator

试用此工具

Hash old key for audit trail

提示词:SHA-256 hash the old API key for audit log storage (never store raw keys in logs)
4

UUID Generator

试用此工具

Create audit event ID

提示词:Generate a UUID v4 as the rotation event ID for tracking

常见问题

How often should API keys be rotated?

Every 90 days for production keys, immediately on team member departure, and instantly if a key is potentially compromised.

Why hash old keys for audit logs?

You need to identify which key was used without storing the actual secret. A SHA-256 hash lets you match against known keys without exposure risk.

相关配方