Rotate a secret

What to expect

The developer console supports app records, scoped API keys, and webhook registration. Registration does not mean webhook delivery is enabled. No isolated sandbox, published quota system, or generic /api/v1 API is documented here. Keep secret credentials on trusted servers.

Rotation should avoid leaving old credentials active indefinitely. This guide covers 3 practical actions, in the order they usually happen.

Do this first

Create a replacement with the required scopes..

Update the consuming service and verify access..

Then finish with

Revoke the old key after the replacement works..

Good to know

Everything here reflects the current Merchant Bridge interface. Labels and buttons may move as the product evolves, but the flow stays the same: prepare, act on the page this guide references, and confirm the result before moving on.

When something does not match what you see, the destination page for this guide is the source of truth.