What does it mean to roll an API key, and why would you do it?

What does it mean to roll an API key, and why would you do it?

• A. It duplicates the key.
• B. It resets the password for the account.
• C. It changes the API key's permission level.
• D. This invalidates the old key and creates a new key; you can use the old key for 12 hours.

Answer: (D)

Rolling an API key is about refreshing credentials to improve security. When you roll a key, you generate a new secret key and the old one is invalidated. There’s usually a transition window (for example, you can keep using the old key for a short period, such as 12 hours) so you can update all your systems to the new key without downtime. This approach minimizes risk: if a key was ever exposed, the window lets you move to the new key and then revoke the old one. It’s not about duplicating the key, resetting a password, or changing permissions—the essence is replacing the key and issuing a fresh one, with a grace period to switch over.

Rolling an API key is about refreshing credentials to improve security. When you roll a key, you generate a new secret key and the old one is invalidated. There’s usually a transition window (for example, you can keep using the old key for a short period, such as 12 hours) so you can update all your systems to the new key without downtime. This approach minimizes risk: if a key was ever exposed, the window lets you move to the new key and then revoke the old one. It’s not about duplicating the key, resetting a password, or changing permissions—the essence is replacing the key and issuing a fresh one, with a grace period to switch over.