English · 한국어 · 中文 · 日本語 · Español

rekey

Reissue an API key with one command, update it everywhere it is used (.env files, Vercel, Railway, Supabase, GCP, GitHub…), and revoke the old one.

pipx install git+https://github.com/golbin/rekey   # install
rekey rotate project:shop   # new keys → every place updated → you choose when each service redeploys
rekey revoke project:shop   # old keys revoked

• Finds the keys you forgot. rekey init doesn't rely on memory: it reads every .env file and Vercel, Railway, Supabase and GCP themselves, and groups identical values, so a key copied into twenty places, including a project nobody remembers, becomes one entry. For places it can't read (a teammate's laptop, a third-party dashboard), add one template line once and it is never forgotten again.
• You don't need to know each service. Keys that can be issued by API are handled automatically; for the rest, rekey opens the right page and you just make the key and copy it.
• Key values never appear on screen. They live only in 1Password.
• Python 3.11+, standard library only.
• Messages follow your system language (English, 한국어, 中文, 日本語, Español). Set REKEY_LANG=en to choose.

How it works

What	Where
Key values	1Password: one vault per environment (Acme - Prod, Acme - Dev, Acme - Local), one item per key, named <project>.<service>
Where each key is used, plus plain settings	targets/<project>/**.tpl in your team's private repo
Exceptions (locked, tags, notes)	keys.toml in your team's private repo

Templates use 1Password's own syntax, and the file path says where the values go.

# targets/shop/vercel/shop/production.tpl  →  Vercel project "shop", production
APP_URL=https://shop.example.com
OPENAI_API_KEY={{ op://Acme - Prod/shop.openai/credential }}

Guides

1. Example team data: see what it looks like, then Use this template
2. Setup: 10 minutes
3. Usage
4. Situations: A key leaked · A platform was breached · Someone left the team

Development

python3 -m unittest discover -s tests
REKEY_TEST_CLIPBOARD=1 python3 -m unittest discover -s tests -p test_interactive.py   # drives a real terminal (macOS, uses the clipboard)

MIT License