Secret key rotation

Secret keys authenticate your trusted backend to HumanPass. Treat them like passwords with access to verification results.

Secret handling rules

• A new secret is displayed once. Store it immediately in your secret manager.
• Never send it to a browser or include it in screenshots, logs, analytics, error messages, or source control.
• Give production workloads access only to the secret for their own site and environment.
• Rotate a secret when access changes or exposure is suspected.

Rotate without downtime

1. In HumanPass → Site → Secret keys, create a new key with a descriptive name.
2. Copy the new value immediately.
3. Add it to your backend secret manager.
4. Deploy or restart every backend instance so all traffic uses the new key.
5. Confirm successful verification and check the new key’s last-used metadata.
6. Revoke the old key.

HumanPass can keep more than one secret active during the rotation window, so you do not need to revoke the old key before deploying the new one.

Suspected exposure

If a secret may be exposed:

1. Create and deploy a replacement immediately.
2. Revoke the compromised key as soon as the replacement is active.
3. Review HumanPass activity and your application logs for unusual verification attempts.
4. Rotate any other credential that may have been exposed by the same incident.

Revoked secret values are not recoverable and must never be accepted again.