$0 in extra software: rotate API keys safely

01 / A $0 software plan, not a promise of free requests

You do not need a paid secrets platform to rotate an API key. For a small application, your existing hosting settings, deployment tool, and a short checklist may be enough. The target here is $0 in additional software purchases. Test requests still cost money, and temporarily overlapping application processes may add hosting charges.

The basic sequence is simple: create a replacement key, test it, move traffic to it, then revoke the old key. Never reverse those last two steps during routine maintenance.

02 / Check two requirements before touching the old key

A no-downtime rotation needs two kinds of overlap: both credentials must remain valid during the change, and your application must keep serving requests while its configuration changes.

• ■ Check whether your API provider allows two active keys. Do not assume that creating a replacement preserves the previous key.
• ■ Check whether your host supports rolling deployments, graceful reloads, or running a replacement process before stopping the original.
• ■ List every consumer: web servers, background workers, scheduled jobs, command-line tools, and deployment checks.

If the provider immediately invalidates the old credential, or your only deployment method stops the application before restarting it, this walkthrough cannot guarantee uninterrupted service. Fix that constraint first or schedule a maintenance window.

03 / Create key B while key A keeps serving traffic

Call the current credential key A and the replacement key B. These are labels for your notes, not the secret values themselves. Create B through your provider's supported key-management interface, keeping A active.

Store B in your host's secret settings or an access-restricted environment file outside version control. Keep the application's variable name unchanged, such as AI_API_KEY; replace its value only in the new deployment. Do not paste either key into tickets, screenshots, source code, or command history.

CheapRelay gives an application one key for multiple AI providers. Its API base is https://api.cheapapirelay.com, with OpenAI-compatible routes under /v1 and Gemini-native routes under /v1beta. During rotation, preserve your existing base URL and request format. Changing credentials and routes together makes failures harder to diagnose.

04 / Spend one small request testing key B

From a separate test process configured with B, send one short request through the same route your application uses. Ask for a brief response and set a small output limit using the parameter supported by that endpoint. Use a model your application already supports, such as Gemini 2.5 Flash, rather than introducing another change.

Confirm that authentication succeeds and the response has the structure your code expects. A successful dashboard login is not proof that an API key works. Avoid repeated tests against real customer traffic.

CheapRelay bills per real token, including cache reads and writes, with no monthly fee or subscription. A small prompt limits the test's scope, but its exact cost depends on the selected model and current rates. Sign up for CheapRelay if that pay-as-you-go setup fits your budget.

05 / Move requests to B without stopping A's workers early

Deploy the application with B through your host's rolling or graceful replacement mechanism. Start the replacement, pass its readiness check, and then route new requests to it. Let existing requests on old processes finish before those processes exit; account for long-running streams and background tasks.

Changing a hosting environment variable does not necessarily update running processes. Verify that every consumer has restarted or reloaded successfully. Record a deployment label such as credential-B in internal logs, never the credential itself.

06 / Revoke A only after the last consumer moves

Check deployment status, authentication errors, pending jobs, and any available per-key usage records. Choose an observation window that covers your longest request and relevant scheduled jobs; an arbitrary five-minute wait may miss a nightly task.

Before revocation, a failed deployment can roll back to the previous configuration while A remains valid. After every consumer uses B, revoke A, remove its stored copies, and record the date. Watch for authentication failures that reveal forgotten consumers.

If A was exposed, prioritize containment over a leisurely rollback window. Revoke it promptly, investigate usage, and accept that restoring security may require interruption. Routine rotation buys overlap; a compromised credential should not buy an attacker more time.