Rotate a secret
Replace a secret that may have leaked, or that policy says to rotate on a schedule, and know what it costs while you do it.
Important
If a secret was committed to git, rotate it before anything else — the copy in
the history, in every clone and in any fork, is already out of your control.
Only then clean the history (git filter-repo) if the repository is shared, and
say so in the changelog, without the value.
Before you start
Know which secret, and where it lives: the server's environment file
(/etc/dataproductfactory.env), .env on a laptop, or the Connections page
for the ones that accept it there — the environment always wins when both are
set. See Configuration for the complete list.
Steps
Each secret has its own consequence and its own fix:
| Secret | Rotating it | Where |
|---|---|---|
SECRET_KEY |
Every session ends — everybody signed in has to sign in again. | environment file / .env |
DPF_LINK_KEY |
Every unlisted link stops working, including ones not yet used. | environment file / .env |
A service token (dpf_…) |
python -m dpf token revoke NAME, then issue a new one under a fresh name — see Issue an API token. |
kept only as a hash, in the database |
DPF_ENTRA_CLIENT_SECRET |
Issue a new client secret on the app registration in Entra, then update it here. Entra caps its life at 24 months and gives no other warning — sign-in simply stops on that day. | environment file, and Entra |
| A warehouse, tracker, ticketing or catalogue credential (Databricks, Azure DevOps, Jira, ServiceNow, Informatica) | Reissue it at the vendor, then replace it here. | environment file, or the Connections page |
ANTHROPIC_API_KEY |
Revoke it at console.anthropic.com, then replace it. Agent steps are unavailable until you do. | environment file / .env, or the Connections page |
On the server, edit /etc/dataproductfactory.env (root-owned, mode 600) and
restart:
sudo systemctl restart dataproductfactoryOn a laptop, edit .env and restart python -m dpf serve. A value typed into
Connections takes effect on the next request — no restart.
Check that it worked
- If you rotated a service token,
python -m dpf token listshows the old name revoked and the new one live. - Sign in again after rotating
SECRET_KEYorDPF_LINK_KEY— the old session is gone.
If it does not work
- Everybody is signed out and you did not mean to rotate
SECRET_KEY. Check that it is actually set in the environment file rather than left to the development default, which changes on every restart. - An Entra sign-in stopped with no change on your side. The client secret expired — Entra gives no warning. Issue a new one.
Related
- Configuration — every variable, which ones are secret, and where each can be set.
- Issue an API token
- Deploy — restarting the service after an edit.