How often should a company rotate API keys?

Clatter Labs doesn't require a rotation schedule, but the Console helps you keep one:

• Expiry dates. Create keys that expire after 30 days, 90 days or 1 year, so old keys can't linger.
• Last used shows which keys are actually in use.
• Names with dates ("Backend 2026-11") make the current key obvious.

Common company practice#

• Rotate production keys on a regular cycle that fits your security policy.
• Rotate immediately when someone who had access leaves, or if a key may have leaked.
• Keep separate keys per environment so rotating one doesn't touch the others.

Good to know#

• Never put a key in front-end code, a mobile app, a public repo or a screenshot.
• Give each integration its own key with only the permissions it needs.

Learn more#

• Limits and best practices
• API keys guide
• Abuse policy

Still need help?#

• General support: support@clatterlabs.com or team@clatterlabs.xyz
• Infrastructure questions, or permanent deletion of your data (your whole account or one service): infrastructure@clatterlabs.xyz

We usually reply within the first hour, and always within 24 hours. A full support team is with you.