Rotate and expire secrets

Who this is for: admins and editors who look after the credentials your workflows use.

Before you start: you need the Manage secrets permission (manage_secrets) to rotate or delete. To show a value you need the Reveal secrets permission (reveal_secret), which only admins have. See Manage users and roles.

Credentials change: passwords get renewed and API keys expire. This page shows how to change a secret’s value without breaking workflows, and how to get reminded before a secret expires.

Rotate a secret

Rotating stores a new value for an existing secret. Once the new value is saved, the previous value is destroyed, so a value that leaked can no longer be read from Liitora. Keep the old value somewhere safe yourself only if you may need it again.

1. Open Secrets.
2. Find the secret under All secrets.
3. Select Rotate.
4. Paste the new value into each field.
5. Change the Expires on date if the new credential has a different expiry (optional).
6. Select Save.

Runs that start after this use the new value. Workflows do not need a new version, because they refer to the secret by name.

Rotate the secret in Liitora right after you change it in the other system, so runs in between do not fail. If the other system lets both keys work for a while, change it there first, rotate here, then turn the old key off.

A secret that was only requested and never filled in has no Rotate button. Use Add the value instead.

Set an expiry date

When you add or rotate a secret, you can pick an Expires on date. Liitora then helps you renew it in time:

• Two weeks before the date, the secret’s status on the Secrets page changes to Expiring.
• Your company’s admins get an email reminder when 30 days, 7 days and 1 day are left, and one more when the secret has expired. Each reminder has a link to add the new value.
• The weekly health digest lists credentials that expire within 30 days.

When the date passes, the status changes to Expired.

What happens when a secret expires

• A workflow that uses an expired secret cannot be activated. The error code is secret_expired.
• Runs that are already active and read the secret fail at the step that needs it, with a message that says the secret has expired.
• Liitora hides expired values from steps on purpose. It does not keep using a credential you marked as expired.

To fix it, rotate the secret with the new value, or add the value from the reminder link. Then run the workflow again, or retry the failed run from the failed step.

Show a value

Sometimes you need to check which key is stored.

1. Open Secrets.
2. Select Show value next to the secret.
3. Confirm with Show it.

The value is shown for 30 seconds and then hidden again. Select Hide now to hide it sooner. Every time a value is shown, the audit log records it with your name. See the audit log.

AI assistants and API tokens can never show a value, even when they belong to an admin.

Delete a secret

1. Open Secrets.
2. Select Delete next to the secret.
3. Read the warning. If workflows or connections still use the secret, the dialog says how many.
4. Select Delete the secret.

The value and all its versions are removed. This cannot be undone. Workflows and connections that use the secret stop working until you add a secret with the same name again.

A signing secret that belongs to a webhook endpoint cannot be deleted on its own. The error code is secret_in_use. Delete the webhook endpoint instead, or see Rotate webhook secrets.

Next steps

• Add a secret
• Test a connection
• Set up alerts