How to
How to rotate a production secret with approval
A production value should not change because someone edited a file. Enable Change Requests on the production environment, propose the new value, and apply it only after review. Then restart the process that reads the environment.
How it works
Three steps for the supported path.
- 01
Turn on Change Requests
Open Project Settings, edit the production environment, and require Change Requests so production edits go through review.
- 02
Propose the new value
Generate the replacement credential in the upstream system, then propose the new value in RunEnv with a short explanation. Do not paste the value into tickets, chat, or prompts.
- 03
Approve, then restart
A reviewer approves the request. Restart the workload so `runenv run` fetches the new version. Use Secret History if an authorized user needs to restore an available previous version.
Require review on production
In Project Settings, edit the production environment and turn on Require Change Requests. After that, an editor proposes a change instead of saving it immediately. Reviewers see a visual diff and can approve or reject it.
Versioning
A supported update creates a new secret version and keeps the previous row as history for the configured retention period. Restoring an available version also creates a new version. It does not erase the record of the rollback.
After the value changes
A process started with `runenv run` receives new values on the next start. Restart application servers after a static secret rotation unless you are on a documented dynamic-secret or SDK live-reload path.