Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThere is no universal rotation interval for API keys and service credentials. Set a schedule for each credential type according to its privileges, exposure, lifetime, and the effort and risk of replacing it. Google Cloud recommends rotating user-managed service-account keys at least every 90 days; that is provider-specific guidance, not a rule for every API key or credential. If compromise is suspected, rotate immediately.
How to choose a rotation interval
Start with the credential’s risk and how it is used, rather than applying one calendar deadline to everything. A persistent credential with broad permissions and many copies has a larger exposure window than a short-lived credential issued to a narrowly scoped workload. Consider these factors for each credential class:
As an Amazon Associate I earn from qualifying purchases.
- Type and lifetime: Is it a persistent API key, service-account key, OAuth client secret, or short-lived credential?
- Privilege and blast radius: What can someone do with it, and which systems or data could be affected?
- Exposure and access history: Where is it stored, who can access it, and is there evidence of unexpected use?
- Replacement feasibility: Can dependent applications accept a new credential without downtime? Can the old one be disabled only after consumers have switched?
- Controls and requirements: Are there provider recommendations or organizational rules that set a cadence?
Document the chosen schedule and any reason a credential needs a different cadence. Available official guidance does not establish one optimal interval for all API keys and service credentials.
What provider guidance actually says
Google Cloud user-managed service-account keys
Google Cloud recommends rotating user-managed service-account keys at least every 90 days to reduce the risk from leaked keys. This applies to that credential type in Google Cloud; it should not be treated as a universal schedule for API keys, certificates, OAuth secrets, or other providers’ credentials. Google’s documented sequence is to create replacement keys, update applications, disable the old keys, monitor applications, and delete the replaced keys. Google Cloud: Service account key rotation.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
These user-managed keys do not expire by default. Google warns that expiry settings for production workloads can cause accidental outages; it recommends managing production key lifecycles through rotation and considering expiry for temporary uses when dependencies are understood. Google Cloud: Best practices for managing service account keys.
Google Cloud API keys
Google Cloud advises periodically creating replacement API keys, updating applications to use them, and deleting the old keys. Its guidance does not set a universal numeric interval for API keys. It also recommends considering more secure authorization approaches, such as IAM policies and short-lived service-account credentials where suitable. Google Cloud: Best practices for managing API keys.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
AWS Secrets Manager control default
AWS Security Hub’s Secrets Manager periodic-rotation control checks whether a secret has been rotated within a configured number of days. Its default is 90 days, and AWS documents a configurable range of 1 to 180 days. This is a control setting, not evidence that all credentials should use a 90-day schedule. AWS Security Hub: Secrets Manager controls.
Free tools Windows power users keep installed
One-click scans. No signup required.
When to rotate immediately
Do not wait for the routine deadline when exposure is suspected. Treat these situations as triggers to revoke or replace the affected credentials promptly:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Suspected or confirmed compromise, leakage, or unauthorized use.
- Removal of a person’s access when that person could access project credentials such as API keys or OAuth client secrets.
- Other exposure events involving a staff member, vendor, repository, configuration file, or system that held a copy.
Google Cloud advises immediate rotation of a service-account key when compromise is suspected. It also recommends rotating project-level credentials if a person whose access is being revoked had access to them. Update applications and check likely locations for copies, including repositories and configuration. Google Cloud: Service account key rotation; Google Cloud: Best practices for managing service account keys.
How to rotate without breaking dependent services
A safe planned rotation replaces the credential in its consumers before removing the old one. The precise overlap period depends on the platform and risk, but the old credential should not remain active indefinitely.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Inventory: Record each credential’s type, owner, permissions, dependent workloads, storage locations, and last-use evidence. Identify unused credentials; Google Cloud recommends disabling keys no longer needed and deleting them once confirmed unused.
- Choose the replacement approach: Prefer identity-based or short-lived credentials when the workload and platform support them. Persistent keys need an explicit owner, schedule, monitoring, and revocation process.
- Create the replacement: Generate or configure the new credential without removing the existing one.
- Update consumers: Deploy the replacement to every dependent application and configuration location.
- Validate use: Confirm that applications authenticate and operate successfully with the new credential.
- Disable the old credential: Monitor for failures or unexpected consumers that still rely on it.
- Delete it after confirmation: Remove the old credential once the replacement is working and dependencies are accounted for.
For a suspected compromise, prioritize containment and follow the incident process rather than allowing an unnecessarily long overlap. Check for copies in repositories, deployment settings, and other configuration locations.
Recommended Free Tools
What automation can—and cannot—do
A secrets-management service can help manage lifecycle tasks, but automation is only effective if it completes the real replacement workflow. AWS Secrets Manager supports lifecycle management and automatic rotation for supported secrets. AWS Secrets Manager: Rotate secrets.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Google Cloud Secret Manager can send rotation notifications based on a configured period or next rotation time. A notification can initiate a workflow; it does not by itself prove that applications received the new secret or that the old one was revoked. Confirm which steps the implementation performs. Google Cloud: Secret rotation.
Test the full lifecycle, including consumer updates, failure alerts, recovery or rollback, and evidence that old credentials were disabled or deleted. A schedule or notification alone is not end-to-end rotation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
