Skip to Content
v1.5Official documentation for the LX CloudPos API · stable in production
v1.5 (current)Authentication and securityKey rotation

API key rotation

Rotating an API key issues a new value without immediately invalidating the previous one, which allows migrating traffic without service downtime.

When to rotate

  • Suspected exposure (accidental commit, an employee leaving, etc.).
  • Internal periodic rotation policy (every 6 to 12 months).
  • After a security incident.

Zero-downtime procedure

Note: during the transition, both API keys remain active. This allows verifying that the new one works before revoking the previous one.

The webhook_secret is preserved during rotation, so there’s no need to reconfigure HMAC verification for webhooks.

ScopesConnection security