API Key Rotation for MAS Environment

Hi MAS Product Team,

We would like to request an enhancement to the API key management workflow to support safer and more reliable automated key rotation.

Current Pain Point
Today, MAS does not appear to support an overlapping validity period where both the old API key and the newly generated API key can remain active simultaneously for a temporary transition window.
This creates significant operational challenges for automated API key rotation, especially for environments enforcing mandatory rotation policies such as every 90 days.

Why This Is a Problem
Without a temporary overlap window:
• API key rotation becomes a hard cutover event instead of a safe transition.
• Distributed systems may experience outages if all services are not updated simultaneously.
• Automation pipelines cannot validate the new key before invalidating the old key.
• Rollback becomes difficult or impossible if deployment issues occur after rotation.
• Multi-environment deployments (prod, staging, DR, workers, integrations, cached secrets, etc.) become operationally risky.
This creates friction for enterprise customers trying to follow security best practices for credential rotation.

Needed Enhancement
We request introducing support for dual-active API keys during a configurable transition period.
Example workflow:
1. Generate a new API key.
2. Both old and new keys remain active temporarily.
3. Customers update all systems and validate connectivity.
4. Old key is automatically retired after the overlap window expires.
Required overlap duration:
• Configurable by tenant/admin
• Typical values:
o 24 hours
o 48 hours
Additional Optional Enhancements
• Key activation/deactivation scheduling
• Expiration notifications
• API-based rotation lifecycle management
• Audit visibility for active/retired keys
• Grace-period enforcement policies

Business Impact
This enhancement would:
• Reduce customer outages
• Improve enterprise adoption
• Enable secure automation at scale
• Align MAS with standard enterprise credential rotation practices
• Reduce operational burden on DevOps and platform teams
This feature would significantly improve the usability and operational maturity of the platform for enterprise environments with strict security and compliance requirements.
Without overlapping key validity, API rotation becomes a risky cutover instead of a safe transition

Thank you for considering this enhancement.