Rotate API Keys with Overlap and Grace Period
Issue the new key, accept both during a grace period, then revoke the old so clients update without downtime.
Task
Implement if (validKeys.has(key) || graceKeys.has(key)) return handle(req); so the service degrades gracefully under failure instead of cascading timeouts to callers.
When to use this
A downstream service slows down and without if (validKeys.has(key) || graceKeys.has(key)) return handle(req); the upstream exhausts its thread pool in 12 seconds.
Prerequisites
- A service with inter-service calls or external dependencies
- A retry or circuit breaker library available
Steps
1. Configure if (validKeys.has(key) || graceKeys.has(key)) return handle(req); in the project configuration file with the recommended defaults.
if (validKeys.has(key) || graceKeys.has(key)) return handle(req);
Expected output: The configuration is accepted and if (validKeys.has(key) || graceKeys.has(key)) return handle(req); runs without errors on the first invocation.
2. Run the check locally to verify if (validKeys.has(key) || graceKeys.has(key)) return handle(req); produces the expected result before pushing.
pnpm test
Expected output: Local run matches CI behavior; no surprises after push.
3. Add the gate to the CI pipeline so if (validKeys.has(key) || graceKeys.has(key)) return handle(req); blocks merge on failure.
- name: Run add api key rotation strategy
run: pnpm test
Expected output: Pull requests with failing if (validKeys.has(key) || graceKeys.has(key)) return handle(req); are blocked from merging.
Troubleshooting
Problem
The check passes locally but fails in CI
Solution
Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.
Problem
Configuration is rejected with a schema error
Solution
Check the tool version matches the config schema; older versions may not support newer fields.
Limitations
- The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
- Configuration drift is possible if someone edits settings outside version control.
Isolate failure
Start by measuring the problem. Issue the new key, accept both during a grace period, then revoke the old so clients update without downtime. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run if (validKeys.has(key) || graceKeys.has(key)) return handle(req); against the current codebase and inspect the output before wiring it into CI.
if (validKeys.has(key) || graceKeys.has(key)) return handle(req);Verify graceful degradation
Once the gate is in place, make failures actionable. A failing if (validKeys.has(key) || graceKeys.has(key)) return handle(req); should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.