Secrets rotation is the process of replacing exposed or aged credentials, API keys, session tokens, certificates, or encryption keys with fresh ones and invalidating the old values. The goal is to limit how long a secret can be abused if it is stolen from code, logs, backups, CI/CD systems, or a compromised endpoint.
In cyber security, rotation is a core containment step after suspected leakage and a routine hygiene measure for privileged accounts and service-to-service authentication. Effective rotation usually includes revoking the old secret, updating every system that depends on it, and verifying that no hidden copies remain. Attackers often hunt for long-lived secrets because they can bypass passwords, MFA, and perimeter controls; defenders rotate them to shrink that window and force re-authentication. Good secret management also uses short-lived tokens, centralized vaults, and audit logs to make rotation faster and less error-prone.