---
title: "Rotating Your API Keys"
source_url: https://docs.rapyd.net/en/rotating-your-api-keys.html
lang: en
---

# Rotating Your API Keys

A guide to rotating your API Keys in Client Portal

You can rotate your API Keys in the Client Portal if your API keys in sandbox or production were compromised, or if you wished to rotate the API keys regularly. You must have Owner permissions.

For example, if you experienced a security breach where your API keys had been exposed to the public, you can rotate your API keys. This allows you to use new API keys.

1. Sign in as described in [Accessing the Client Portal](https://docs.rapyd.net/en/accessing-the-client-portal.md "Accessing the Client Portal") and tap **Developer**.

   The **Credentials Details** page appears.

   ![648089a8331d7.png](image/img-541e8853c07e2da51ed2e8609e0507e6.png)
2. Click the **Rotate API Keys** button.

## How to Rotate API Keys

1. On the **Credentials Details** page within the **Developer** tab, select the **Rotate API Keys** button.

   The **Choose when to revoke the existing key** dialogue box appears.

   ![648089aa4ec24.png](image/img-d9fdaa74dbcb86313178eba1c428b34f.png)
2. Select the time limit when you would like to rotate your API Keys in the **Within** field, ranging from **Now** to **Seven Days**.

   ![648089abecc9e.png](image/img-7fdc1519becf800757cc31042c6b1fd2.png)
3. Click **Next**.
4. The **Warning!** dialogue box appears.

   ![648089ade17c1.png](image/img-54321f96eb11bebef54404371c317596.png)

   > **Tip:**
   >
   > Make sure to update any script or program with the new API Keys, and accept Webhooks with either the new or previous API keys until the previous API keys are revoked. Not updating such scripts on time will prevent any payments that used the previous API keys.
5. Click the checkbox that says **I confirm rotating the API keys**.

   ![648089afeabc6.png](image/img-cc66ca042a4bbcf73780105b6578222f.png)
6. Click **Next**.

   The **Authenticator App** dialogue box appears.

   ![648089b1d8440.png](image/img-559dab52bdad0fea632fe28eb20dd21a.png)
7. Enter your OTP.
8. Click **Submit**.

   The confirmation window appears.

   ![648089b3a0f13.png](image/img-449862d6003163ecb7bb764c6a45682e.png)
9. An email notification will inform you the API keys have been rotated, and state when the previous API keys expire. The notification will be sent to users who have permission to view the API Keys.

## How to Rollback API Keys

You can rollback your API Keys in production or sandbox in Client Portal. Performing a rollback of your API keys will delete the newly generated keys. This allows you to use your previous API keys instead.

You must have Owner permissions to perform this action. You can only rollback your API Keys after rotating the API Keys.

1. On the **Credential Details** page within the **Developer** tab, select the **Rollback API Keys** button.

   ![648089b58ec44.png](image/img-fb205a532ad4666c02227ace3490abbb.png)
2. The **Warning!** dialogue box appears.

   ![648089b77ec06.png](image/img-284f8ee9a212c01a848e59a69ff5d1fc.png)

   > **Tip:**
   >
   > This action will delete the new API keys and keep the previous API keys active. Make sure all scripts and programs use the active API keys to avoid payments failure.
3. Click the checkbox that says **I confirm rolling back the API keys immediately**.

   ![648089b91ee2a.png](image/img-7047e859a317ab447449772af5847687.png)
4. Click **Next**.
5. The **Authenticator App** dialogue box appears.

   ![648089bb13bf8.png](image/img-ae9f0d34917f44ee21e9732341196f17.png)
6. Enter your OTP.
7. Click **Submit**.

   The confirmation window appears.

   ![648089bc95640.png](image/img-1c05bedd8d9cb0eafeb0cc1ff40d05a3.png)
8. An email notification will inform you the API keys have been rolled back. The notification will be sent to users who have permission to view the API Keys.

   > **Note:**
   >
   > If you need more time to update your scripts with the new API keys prior to the previous API keys expiring, please contact support.