> ## Documentation Index
> Fetch the complete documentation index at: https://docs.terabusinessfinance.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Key rotation and revocation

> How Tera staff rotate and revoke supplier credentials. Secrets are never recoverable.

Tera staff issue, rotate, and revoke credentials. There is no supplier self-serve portal in V1.

## Rotation

1. Ask Tera to issue a **new** credential in the same environment with the scopes you need.
2. Store the new secret. It is shown once.
3. Switch your integration to the new `Authorization` value.
4. Ask Tera to **revoke** the previous public credential id.

Multiple active credentials can exist during rotation so you can overlap cutover.

## Revocation

Revoke immediately if a secret may have leaked. A revoked key returns **401**. In-flight requests already accepted are not undone; poll those `submission_id`s as usual.

Tera stores a public credential id plus a keyed HMAC of the secret. Plaintext cannot be recovered after first display.

## Environment isolation

* Rotate sandbox and production independently.
* A revoked sandbox key does not affect production, and the reverse.
* After revoke, issue a new key rather than asking Tera to “resend” the old secret.

## What to send Tera

Quote the **public credential id**, environment, and the `X-Request-Id` response header of any failing call. Do not paste the secret into email or chat.