• State Suggested Answer
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 2 subscribers
  • Views 2 views
  • Users 0 members are here
Options
Related

API key rotation with zero downtime

Fatima Al-Rashid

From a governance perspective, we are required to rotate API credentials every 90 days per our information security policy. It is worth noting that we currently have seven production integrations consuming the FieldPulse API, including our customer portal, billing reconciliation service, and two vendor data feeds.

I have confirmed that the API key management interface supports only a single active key per account. When generating a new key, the previous key is immediately invalidated. This presents a significant operational risk: any credential rotation will result in service interruption until all seven integration points are updated and redeployed.

I am seeking clarification on the following points:

  1. Does FieldPulse support multiple concurrent API keys, or is there a mechanism to stage a new key before invalidating the existing one?
  2. If not, what is the recommended approach for credential rotation in high-availability environments?
  3. Are there plans to implement scoped API keys with independent lifecycle management?

Our current workaround involves scheduling rotation during a maintenance window, but this does not satisfy our continuous availability requirements. I would appreciate any guidance on how other organizations have addressed this constraint.

Parents
  • 0

    +1 to Eli's dual account approach — that's what we ended up doing. Heads up though: if you're using webhooks, you'll need to reconfigure those on the second account too, and the account_id in the payload will be different. Caught us off guard the first time.

    YMMV, but we also found that FieldPulse's rate limits are per-key, not per-account, so running two accounts in parallel during migration actually doubled our throughput temporarily. Worth noting if you're dealing with large backfills.

    One other gotcha: custom field definitions don't sync between accounts, so we had to script a one-time export/import. Took about an hour to sort out.

Reply
  • 0

    +1 to Eli's dual account approach — that's what we ended up doing. Heads up though: if you're using webhooks, you'll need to reconfigure those on the second account too, and the account_id in the payload will be different. Caught us off guard the first time.

    YMMV, but we also found that FieldPulse's rate limits are per-key, not per-account, so running two accounts in parallel during migration actually doubled our throughput temporarily. Worth noting if you're dealing with large backfills.

    One other gotcha: custom field definitions don't sync between accounts, so we had to script a one-time export/import. Took about an hour to sort out.

Children
No Data