/
Menu

Rotate or renew

Replace a key, password, database credential or certificate, or renew a domain, subscription or membership, one step at a time.

The Rotate or renew playbook walks you through replacing a value without breaking anything that uses it, or renewing something that is about to lapse.

#Before you start

  • Unlock your vault. See Unlock your vault.
  • Keep the old value active until the new one works. The playbook puts the revoke step last for that reason.
  • If you want your browser to send the new value to Vercel, GitHub or Netlify, set up a deploy target on the item first. See Deploy targets.

#Start a run

Open the item and choose one of these buttons:

  • Rotate for a key, login, certificate, secure note or database credential.
  • Renew for a domain, subscription or membership.
  • Fix this, which appears in the same place when the item has an alert. It starts the same run.

You can also start it from the Fix card on Home or from an item on a project page. If a run for the item is already in progress, the button reads Resume rotation or Resume renewal and takes you back to it. See Runs.

#Steps for a key, password or credential

  1. Generate a new key at the provider. For a database it reads Reset the database password. A button opens the right page at the provider. Create the replacement with the same permissions and keep the old one active.
  2. Save the new value in StackHangar. Paste the new value, pick a Reminder (Remind me on a date, Every 90 days, Every 180 days, Every year or No reminder) and choose the save button, such as Save new key. It is encrypted on your device. The value is never added to the run.
  3. Update it in each place the item says it is used. This step is optional. If the item lists no places, one step reads Update it anywhere else you use it.
  4. Push the variable to each deploy target on the item, then redeploy it. Both steps are optional. See Deploy targets.
  5. Verify it works. Deploy or run a request and check that nothing fails.
  6. Revoke the old key. Do this at the provider only after the new one works. This is what makes the rotation count: a leaked old key stops working.

Steps 5 and 6 wait for the steps before them, and show Waiting until those are done or skipped.

#Steps for a domain, subscription or membership

  1. Renew at the provider. A domain that has lapsed gets an extra note.
  2. Turn on auto-renew. Optional.
  3. Save the new renewal date. Copy it from the confirmation email or the dashboard, then choose Save renewal date.

#Finish

When every required step is done and the rest are done or skipped, choose Finish. The summary lists, for each item, whether the new value was saved, where it was sent, whether the old one was revoked and the item's current reminder. If the old value wasn't revoked in this run, the summary says so.

If you can't finish now, leave the run. It stays under In progress, and you can come back at any time.

#Using an agent

If an agent proposed the run, a Your agent card on the run lists the steps it may run. Revoking the old value needs your permission: choose Allow the agent to revoke, which asks for a passkey check, and you can Withdraw permission later. Agents running steps needs Solo. See Agent proposals.

#If something goes wrong

  • If sending to a deploy target fails, the step shows a fixed message and a by-hand route. See Deploy targets.
  • If the item was deleted after the run started, its steps say so. Skip them or abandon the run.
  • If several items hold the same value, use Leaked key, which covers all of them in one run.