Rotate a leaked key without breaking production.
KeyOps creates the replacement, writes it to every consumer, proves it works, then revokes the old key. If any step fails, it rolls back.
Finding the key is the easy part.
The hard part is replacing one credential everywhere it lives without taking production down. Most tools stop at the alert.
01 / scanners
They find the leak.
GitHub secret scanning, gitleaks, and trufflehog are good at detection. None of them replace the key in Vercel, GitHub Actions, and your local env.
02 / gateways
They change your code.
A proxy adds a new network hop, a new failure mode, and a migration. Your app still needs a real key at the edge.
03 / keyops
It changes the secret.
One transaction: create, fan out, verify, revoke. Every step has a rollback. No proxy in front of your traffic.
A rotation transaction, not a checklist.
Plan first, approve the change, then let KeyOps execute the steps in order. The run log records what changed and what was rolled back.
# 1. See the plan. Nothing changes.
$ keyops plan OPENAI_API_KEY
# 2. Rotate with approval.
$ keyops rotate OPENAI_API_KEY --approve
output
ok create replacement
ok write .env.production
ok update Vercel production
ok verify new key (200)
ok revoke old key
run_7f3a91 complete
Install from GitHub. npm publish is next.
Six steps. One rollback path.
KeyOps does not revoke the old key until the new one has passed a real request. If anything fails before that point, the run restores the old key to every consumer.
Start with a free auditPreflight
Validate the manifest and admin token. Lock the run.
Escrow
Encrypt the old key and consumer values locally.
Create
Create a scoped replacement key with an expiry.
Fan out
Write Vercel, GitHub Actions, and local env in order.
Verify
Call the provider with the new key and expect 200.
Revoke
Deactivate the old key only after the new one passes.
Paste a config. See the keys.
The browser audit masks every value and never uploads your text. Use it for a quick check. Use the CLI for tracked files, ignored files, and connected platforms.
Open the audit toolOpenAI project key
sk-proj-ab...9f2a
Anthropic API key
sk-ant-api...77bd
OpenRouter key
sk-or-v1-...c410
Values are masked before render. Nothing is sent to a server.
See what is old, unused, or expensive.
Acme AI
overview
AI keys
12
5 providers
Need rotation
3
older than 90d
Spend
$4,280
+18% this month
Exposed
0
last 30 days
Start free. Pay for the rotation.
The audit is free and local. The paid tier is for teams that want a hosted run history, approvals, and a second pair of eyes.
Starter
$99/mo
for small AI teams
3 providers
25 keys
Hosted run history
Weekly digest
Assisted rotation
Team
$249/mo
for agencies and platform teams
10 providers
100 keys
Slack alerts
Approval workflows
Priority support
Need the rotation done for you? A fixed-price audit and first rotation is $1,500.
The honest answers.
KeyOps is deliberately narrow. It rotates what can be rotated and says so when a provider needs a human.
Do you store my raw keys?+
No. The audit masks values. Rotation uses admin tokens stored in your OS keyring or environment. The old key is encrypted in local escrow only for the duration of the run, then removed.
Can it rotate Anthropic keys?+
Assisted. Anthropic does not create keys through its API, so KeyOps prompts for the key you create in the console, writes it everywhere, verifies it, then deactivates the old key.
Is this a gateway or a proxy?+
No. Your traffic never passes through KeyOps. It changes the secret where it already lives, so there are no code changes and no new latency.
What happens if rotation breaks a consumer?+
The run stops and restores the old key to every consumer from encrypted escrow. The failure is recorded with the exact step that failed.
Why not rotate every week?+
Weekly rotation is a bad default. It creates downtime and does not fix a key that was copied before the rotation. KeyOps supports scheduled rotation, but the safe default is event-driven: after a leak, a departure, or an incident.
Find the key before someone else does.
Run the free audit. If it finds something, you will know exactly where it is, what it can spend, and how to rotate it safely.