How do I rotate my Neon API keys after they've been exposed?

Neon API keys don't expire or rotate on a schedule, so you rotate them by hand. If a key was exposed, revoke it first (revocation is immediate), then create a replacement and update every CI job, script, or service that used it. For routine rotation, create the replacement first, roll it out, then revoke the old key, so nothing loses access in between. Personal, organization, and project-scoped keys all work this way (Rotate an API key).

Revoke the compromised key

Revocation is immediate and permanent. Any request that uses the revoked key fails with 401 Unauthorized, and you can't reactivate it.

You can also revoke a key with the CLI or API, using the numeric key ID (not the name) from the key list. For a personal key:

neon api-keys revoke $KEY_ID

# or with the API
curl -X DELETE \
  "https://console.neon.tech/api/v2/api_keys/$KEY_ID" \
  -H "Authorization: Bearer $NEON_API_KEY" \
  -H "Accept: application/json"

For organization and project-scoped keys, pass --org-id to the CLI command, or use the Revoke organization API key endpoint. See Revoke API keys.

Create a replacement key

Create a new key with the same scope as the old one, and give it a name you'll recognize in the key list. For routine rotation, do this before you revoke the old key.

In the Console, go to Settings → API keys from the profile menu (personal) or from your organization (organization or project-scoped), and click Create new. From the CLI, run neon api-keys create, adding --project-id for a project-scoped key.

From the API, the endpoint depends on the key type. For a personal key:

curl https://console.neon.tech/api/v2/api_keys \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $PERSONAL_API_KEY" \
  -d '{"key_name": "ci-pipeline-rotated-2026-05"}'

For an organization key, call the organization endpoint with a personal API key. Add project_id to make it project-scoped:

curl https://console.neon.tech/api/v2/organizations/$ORG_ID/api_keys \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $PERSONAL_API_KEY" \
  -d '{"key_name": "ci-pipeline-rotated-2026-05", "project_id": "some-project-123"}'

The new key is shown only once, so copy it into a secret manager right away. See Creating API keys.

Update everything that used the old key

Update every caller that used the old key:

• GitHub Actions, GitLab CI, CircleCI, or other CI secrets that hold NEON_API_KEY
• Terraform Cloud or self-hosted Terraform variable stores
• The Neon CLI, wherever it authenticates with NEON_API_KEY or --api-key
• Any custom scripts, serverless functions, or workflows that call the Neon API
• MCP server configurations that authenticate with the Neon API

For broader credential rotation (Postgres passwords plus API keys), see How do I rotate all my Neon database credentials?.