Rotate and revoke credentials
Replace an application credential with a new one while the old one keeps working, revoke a credential at once, and see why the platform revokes credentials.
Rotate a credential to replace it with a new one, with a new ID and secret, without downtime: the old credential keeps working for an overlap window while you update your clients. Revoke a credential to delete it at once, so it can't be used to sign in again.
Before you begin
- To rotate a personal credential, you must be its owner. To rotate a service account's credential, you need the same access as to create one. See Create an application credential.
- Rotating needs a recent two-factor verification: the console asks for a code from your authenticator app unless you entered one on this session in the last 5 minutes. See Step-up verification.
- To revoke a credential, you must be able to see it: your own credentials; service accounts' credentials with Manage access to API Tokens; any credential with Manage access to Identity & Access.
Rotate a credential
In the console, go to Identity & AccessOpenStack API access.
On the credential's row, open the menu, and select Rotate credential.
In Old credential keeps working for, choose how long the old credential keeps working: Delete it immediately, or 1, 24, 72, or 168 hours. The default is 24 hours.
Select Rotate credential. If the console asks for it, enter a code from your authenticator app.
Copy the new Application credential ID and Secret, or download the new files. Both the ID and the secret change. The secret is shown once.
Update your clients before the overlap window ends.
Result
The new credential has the same owner, project, profile, and name as the old one, and the same lifetime, counted from now. You can rotate only an active credential that hasn't been rotated yet.
Until the overlap window ends, the list shows the old credential as replaced, with the time when it stops working. Then it's deleted. If you choose Delete it immediately, it's deleted at once.
Creating or rotating a credential ends the current OpenStack tokens of its owner. Clients that use any of the owner's credentials, including the one that you rotated, get one 401 Unauthorized response and must sign in again with their credential.
For a Kubernetes cluster, see Rotate the cluster's credential.
Revoke a credential
Go to Identity & AccessOpenStack API access.
On the credential's row, open the menu, and select Revoke.
In the dialog, select Revoke.
The credential is deleted in the cloud and can't be used to sign in anymore. You can't undo a revocation. Revoking doesn't ask for a code from your authenticator app.
Expiry
Every credential expires at the end of the lifetime that you chose when you created it. An email goes out when 14 days or fewer are left, and again when 3 days or fewer are left: to the owner, or for a service account's credential, to the member who created it. When the credential expires, it stops working and is listed as Expired. To keep a client working, rotate the credential before it expires.
Why a credential stopped working
Besides your own actions, the platform revokes credentials when the access behind them changes. The credential list shows the reason:
| Reason | What happened |
|---|---|
| Revoked | Someone revoked the credential. |
| Replaced by rotation | The credential was rotated, and its overlap window ended. |
| Role changed — create a new one | The owner's role in the project changed so that their OpenStack role was lowered, for example from member to reader. |
| Member or service account removed | The member was removed from your organization, or the service account was deleted. |
| API access switched off | An owner switched off OpenStack API access for your organization. |
| Revoked by the platform operator | The platform operator revoked the credential. |
| Gone from the cloud | The credential no longer exists in the cloud. |
| Expired | The credential reached the end of its lifetime. |
When a member or a service account is deactivated, its credentials are deleted too, and they don't come back when it's reactivated. In every case, create a new credential if the access is still needed.
Revoked and expired credentials stay in the list for 90 days, and are then removed from it.
Last used
The Last used column shows when the credential was last used to sign in to the cloud. It isn't updated on every API call, because clients reuse their sign-in token for a while.