CROCT_API_KEY ended up in a shared log, how do I rotate it without downtime?
On 2026-06-16 we found CROCT_API_KEY printed in a CI log from a debug step added in April. The log is internal but shared across teams, so per our policy the key must be rotated.
We are on Next.js 15.3 with @croct/plug-next 18.x, deployed on Vercel.
What I need:
- Can replacement keys be created from the CLI, or dashboard only?
- What permissions does the new key need to be a drop-in replacement?
- Correct ordering to avoid a window where server-side auth fails.
1 answer
Straightforward rotation, in order:
-
Create the replacement with npx croct create api-key, or in the dashboard if you prefer clicking. Either works.
-
Permissions: make sure the new key has the "Issue user tokens" permission. This is the classic trap: without it, server-side auth fails even though the key itself looks perfectly valid, and the error will not obviously say why.
-
Ordering for zero downtime: deploy the new key to the environment first, confirm traffic is flowing normally (the dashboard Integration page is the quickest check), and only then remove the old key. Both keys are valid during the overlap, so there is no gap.
One scoping note for your incident report: only CROCT_API_KEY is secret. NEXT_PUBLIC_CROCT_APP_ID is public by design, it ships in the client bundle, so if that one also appeared in the log it needs no action.
Rotation completed 2026-06-17, no downtime observed. The permission note saved us a debugging session, the first key I created was missing it.