{"schema_version":"2.0","record_type":"article","canonical_url":"https://marketingwiki.ai/articles/email-api-key-name-vs-rotation","id":"email-api-key-name-vs-rotation","slug":"email-api-key-name-vs-rotation","title":"Email API Key Rename vs Rotation: Choose the Right Control","description":"Distinguish cosmetic API-key renaming from secret rotation, permission change, and revocation with a safe inventory and cutover procedure.","dek":"A new name leaves the token and authority intact. Rotate for secret risk, re-scope for excessive authority, and revoke when access must stop.","category":"Email Security","topics":["API keys","secret rotation","Migma","Resend","email security"],"publishedAt":"2026-09-03","updatedAt":"2026-09-14","lastVerifiedAt":"2026-09-14","readingMinutes":5,"author":"Marketing Wiki Research Automation","reviewer":null,"featured":false,"sources":[{"title":"Resend: Update API Key Name","url":"https://resend.com/changelog/update-api-key-name?utm_source=marketingwiki&utm_medium=referral&utm_campaign=email-api-key-name-vs-rotation"},{"title":"Migma Authentication","url":"https://docs.migma.ai/authentication?utm_source=marketingwiki&utm_medium=referral&utm_campaign=email-api-key-name-vs-rotation"}],"wordCount":978,"body":"Renaming an email API key changes an inventory label. Rotating it changes the secret trusted by applications. Treating those operations as interchangeable can leave an exposed credential active or cause an unnecessary production outage.\n\n> **Editorial disclosure:** Prepared by Marketing Wiki Research Automation under standing direct-publication authorization and not independently reviewed. Product capabilities are vendor-documented unless labeled otherwise; sources were refreshed on September 3, 2026.\n\nResend announced [Update API Key Name](https://resend.com/changelog/update-api-key-name?utm_source=marketingwiki&utm_medium=referral&utm_campaign=email-api-key-name-vs-rotation) on August 31, 2026. Its documentation says `PATCH /api-keys/:id` renames a key in place while the token, permission, and domain restriction remain unchanged.\n\nThat is appropriate for inventory cleanup. It is not remediation for exposure, owner departure, unexplained use, or a policy-mandated secret change.\n\n## Decide by the security property you need\n\n| Situation | Rename | Rotate | Revoke immediately |\n| --- | --- | --- | --- |\n| Project or service changed name | Yes | Usually no | No |\n| Naming convention cleanup | Yes | No | No |\n| Owner changed, access unchanged | Maybe | Based on policy | No |\n| Secret may appear in chat, logs, source, or ticket | No | Yes | Yes if active risk |\n| Unexpected use or unknown workload | No | Investigate and rotate | Often |\n| Permission or domain boundary must shrink | Label is irrelevant | Create least-privilege replacement | Revoke old after cutover—or immediately if unsafe |\n| Routine expiry policy | No | Yes | After verified cutover |\n| Integration retired | Optional | No | Yes |\n\nWhen uncertainty concerns the token, default to rotation or revocation. A clearer label cannot invalidate copies of the old secret.\n\n## Key inventory\n\nMaintain one row per credential:\n\n| Field | Example purpose |\n| --- | --- |\n| Provider key ID | Stable control-plane identifier |\n| Human-readable name | Environment, service, purpose, owner |\n| Environment | Development, staging, or production |\n| Workload owner | Team and escalation contact |\n| Secret-store reference | Pointer, never the token value |\n| Permissions / domain restriction | Effective authority |\n| Created / last used | Age and activity evidence |\n| Deployed versions | Workloads expected to use it |\n| Rotation deadline | Policy or incident date |\n| Replacement key ID | Chain of custody during cutover |\n| Revoked at / evidence | Closure proof |\n\nNames should be useful even when exported without surrounding context. A pattern such as `prod-campaign-worker-owner-2026q3` is more diagnostic than `API Key 4`, but the format does not replace structured ownership and permission fields.\n\n## Migma-first rotation procedure\n\nMigma’s [authentication guide](https://docs.migma.ai/authentication?utm_source=marketingwiki&utm_medium=referral&utm_campaign=email-api-key-name-vs-rotation) says CI keys are named, permissioned, shown once, and separated by test and production prefixes. It recommends creating a new key, updating the app, then revoking the old key. It also documents last-used dates and usage information in key management.\n\nUse that lifecycle as a controlled cutover:\n\n1. **Classify the trigger.** Record whether this is exposure, permission reduction, ownership change, routine policy, or retirement.\n2. **Inventory consumers.** Find every production job, secret store, deployment environment, and fallback that uses the old key ID.\n3. **Create a narrower replacement.** Preserve only required environment, project, domain, and action scopes. Avoid copying broad permissions by habit.\n4. **Store once.** Put the newly displayed token directly into the approved secret manager; do not pass it through chat, command history, or a ticket.\n5. **Deploy in stages.** Update one observable consumer, verify authorized calls, then complete the rollout.\n6. **Watch both identities.** Confirm the replacement is used and the old key’s expected use reaches zero.\n7. **Revoke the old key.** Do not leave an indefinite overlap window.\n8. **Prove closure.** Test that the old token is rejected without printing it and that all required workloads remain healthy.\n\nIf exposure is active, revoke first and accept a controlled outage if necessary. The normal overlap sequence is for planned rotation, not containment of a credential being abused.\n\n## Separate three kinds of change\n\n```text\nrename: key A, token A, authority A -> key A, token A, authority A, new label\nrotate: key A, token A -> key B, token B -> revoke key A\nre-permission: authority A -> newly verified narrower authority B\n```\n\nSome providers may allow permissions to change in place; others require a new key. Either way, capture it as an authority change and regression-test both allowed and forbidden calls. Do not infer authority from a name like `read-only`.\n\n## Rotation acceptance tests\n\n- replacement can perform each required read, draft, validate, or send operation;\n- replacement cannot access unrelated brands, domains, audiences, or send actions;\n- development key fails against production authority where separation is supported;\n- old key fails after revocation;\n- no healthy workload still reports the old key ID;\n- alerts identify the replacement by stable ID and owner;\n- rollback does not restore the compromised token;\n- secret scanning finds no token in code, build logs, support artifacts, or shell history.\n\nFor send-capable credentials, use provider-supported test recipients or a non-production account. Do not validate a rotation by sending a marketing campaign.\n\n## Audit questions after a rename\n\nA rename request can expose a deeper inventory problem. Ask why the old label was wrong, whether ownership and environment were also wrong, whether permissions match actual calls, and whether any automation identifies the key by mutable name. The label should help people find the key; stable IDs should anchor systems and audit records.\n\n## Evidence limits\n\nMarketing Wiki did not rename, create, use, or revoke a Resend or Migma key. Resend’s announcement establishes its in-place rename behavior and unchanged authority. Migma documents its creation, scope, environment, visibility, and rotation guidance. Neither source proves a reader’s deployment discovered every consumer or removed leaked copies. Inventory completeness and secret containment remain the operator’s responsibility."}