How to rotate keys and secrets
Rotate a key when it may have leaked, or when someone with it leaves. What you do depends on which key.
Access keys (one repository)
- On the repository's Agents tab, under Working access keys, press Cancel on the key, then Cancel the key to confirm.
- Make a new one with Make an access key and give it to the agent as
MERGEPACE_TOKEN.
Other access keys keep working.
Access keys (one computer)
Run mergepace logout on that computer. It cancels the key on the server
and deletes the file. Then sign in again with mergepace login.
Server secrets
- GitHub App private key and client secret: create a new one on the app's page on the code host, put it in your platform's secret store, and restart the server. Then delete the old key on the code host.
MERGEPACE_TOKEN_KEY: changing it cancels all access keys at once. Make new access keys for each repository, and expect every agent to stop until it has one.MERGEPACE_API_TOKEN(the server-wide access key): set the new value on the server. Every script or agent that uses the old value stops; give them the new one.
Coming with #1028: rotating server secrets without breaking keys. This page changes when it lands.