Best Practice Rotate API Developer Keys

Question

Hi everyone. Can someone please give me instructions/best practices for rotating the API keys?

Is it: create a new developer key for each existing key —> Email tool support with new deployment id, client id —> Hear from tool support that key is operational —> Delete old key ??

Is this process written up somewhere?

Thank you!

hburgiel · Answer

I have the same questions. I suspect that the answer to your first question is "follow the instructions given to you by your third-party provider". The vendors' online instructions for setting up an LTI connection seem to contain most of what we need to change our developer key and any associated API tokens as well.

Did you see this article on inherited developer keys? I think it confirms that inherited keys are managed by Instructure.

jschreier · Answer

Furthermore. My understanding is that we only need to rotate the API/LTI keys that we have created. "Inherited" keys have been updated or rotated by Instructure. Correct? Thank you.