# Rotating and revoking keys

> Swap StrideHQ API keys without downtime, revoke a key, and see what a key has done.

## Rotate a key

Each organisation can have two active keys per environment, so you can swap keys without downtime.

1. Create a new key with the same scopes.
2. Update your system to use the new key.
3. Check the old key's **Last used** time has stopped changing.
4. Revoke the old key.

## Revoke a key

In **Settings > Developers > API keys**, select the key and choose **Revoke**. It stops working immediately. Requests that use it get a `401`.

Revoking can't be undone. Create a new key if you need access again.

## See what a key has done

For each key, Owners can see:

- when it was created, and by whom
- when it was last used
- the last 30 days of requests: time, endpoint, status and request ID

Every change made through the API also appears in StrideHQ's activity log as "via API", with the key's name.

## Next steps

- [Environments and sandbox](https://developers.stridehq.ai/api-documentation/environments-and-sandbox.md): what's in the sandbox and how to move to production.
- [Webhooks](https://developers.stridehq.ai/api-documentation/webhooks.md): get told when things change.
- [API reference](https://developers.stridehq.ai/api-documentation/api-reference.md): every endpoint, field and error.