Key Rotation

Rotation replaces a credential on an existing IntegrationClient with a new one, without changing the client’s scopes, store restriction, or tenant. It’s performed by an EPOS owner in Back Office Developer Tools, on your behalf - ask them when you need a rotation.

When to rotate

• On a regular schedule, as a routine security practice.
• Immediately, if a key may have been exposed (committed to source control, logged, shared insecurely) - see Security.
• As part of onboarding a new deployment environment for your own integration.

What happens

1. A new credential (new secret, new public prefix) is created for the same IntegrationClient.
2. The new secret is shown once, at that moment - capture it immediately.
3. The previous credential is marked revoked and stops authenticating.

Rotation is a single action, not a two-step “create then separately revoke” - there’s no overlapping grace period where both keys work side by side. Plan for a brief cutover: have your new key ready to deploy before requesting rotation, since the old one stops working as part of the same action.

After rotating

• Update wherever the key is stored (environment variable, secret manager) in your deployment.
• Restart/redeploy your integration’s backend so it picks up the new value.
• Confirm a request succeeds with the new key before considering the rotation complete.

See Key Revocation for what happens if a key needs to be disabled without a replacement.