Rotate a key

Rotate when a key may have leaked, when someone with access to it leaves, or simply as periodic hygiene. Rotation happens per store, in Settings.

The steps

1. Open Console → Settings → Stores & API keys, and find the store’s row.
2. Click “New API key”. A confirmation dialog reminds you the current key is revoked immediately — confirm.
3. Copy the new key from the amber one-time panel. This is your only chance; only its hash is kept.
4. Update wherever your integration stores the key (typically an environment variable in your deployment) and redeploy.

How rotation behaves (no zero-key window)

Under the hood, the new key is created FIRST and the old one revoked second. That ordering means your store always has at least one active key — even a failure mid-rotation can only leave an extra active key, never zero.

Once rotation completes, the old key stops working immediately: events sent with it are rejected (HTTP 401) and simply not recorded. Nothing about your storefront is affected — event reporting is fire-and-forget by design, so a revoked key can never slow down or break your site. The only cost of a slow update is a gap in your visit log until the new key is deployed.