Zero-downtime key rotation process with grace periods.

Recommended Procedure

1. Rotate key with grace_period_minutes.
2. Deploy new key to all clients.
3. Observe traffic and auth failures.
4. Confirm no traffic uses old key.
5. Allow grace to expire (or explicitly revoke old key).

Verification

• New key authenticates successfully.
• Old key works only before grace_expires_at.
• Audit events show api_key.rotate and any revoke actions.