deployment-token-rotation

You rotate deployment tokens by executing a dry-run preview first, then explicitly applying changes via the Vercel and Railway CLIs using new secret values supplied through environment variables and jq-based JSON patches.

The safest way to update a leaked API token is using a controlled, auditable rotation process that defaults to dry-run previews, requires explicit confirmation to apply changes, and includes verification steps and rollback guidance using the previous known-good value.

Yes, you can preview secret rotation changes. The rotation scripts default to a dry-run mode that previews the changes, requiring an explicit --apply flag to execute the updates across your Vercel and Railway environments.

Yes, you need jq, the Vercel CLI, and the Railway CLI installed. These tools are required to apply the JSON patches and execute the environment variable updates during the token rotation process.

You handle scheduled key rollovers by running the rotation scripts against your development context, previewing the shared variable updates in a dry-run, and applying the changes with the Railway CLI when ready.

If token rotation breaks your application, you should follow the rollback guidance to restore the previous known-good value, then monitor health checks, integration calls, and logs to verify service stability.