English · 한국어 · 中文 · 日本語 · Español
Reissue an API key with one command, update it everywhere it is used (.env files, Vercel, Railway, Supabase, GCP, GitHub…), and revoke the old one.
pipx install git+https://github.com/golbin/rekey # install
rekey rotate project:shop # new keys → every place updated → you choose when each service redeploys
rekey revoke project:shop # old keys revoked- Finds the keys you forgot.
rekey initdoesn't rely on memory: it reads every .env file and Vercel, Railway, Supabase and GCP themselves, and groups identical values, so a key copied into twenty places, including a project nobody remembers, becomes one entry. For places it can't read (a teammate's laptop, a third-party dashboard), add one template line once and it is never forgotten again. - You don't need to know each service. Keys that can be issued by API are handled automatically; for the rest, rekey opens the right page and you just make the key and copy it.
- Key values never appear on screen. They live only in 1Password.
- Python 3.11+, standard library only.
- Messages follow your system language (English, 한국어, 中文, 日本語, Español). Set
REKEY_LANG=ento choose.
| What | Where |
|---|---|
| Key values | 1Password: one vault per environment (Acme - Prod, Acme - Dev, Acme - Local), one item per key, named <project>.<service> |
| Where each key is used, plus plain settings | targets/<project>/**.tpl in your team's private repo |
| Exceptions (locked, tags, notes) | keys.toml in your team's private repo |
Templates use 1Password's own syntax, and the file path says where the values go.
# targets/shop/vercel/shop/production.tpl → Vercel project "shop", production
APP_URL=https://shop.example.com
OPENAI_API_KEY={{ op://Acme - Prod/shop.openai/credential }}
- Example team data: see what it looks like, then Use this template
- Setup: 10 minutes
- Usage
- Situations: A key leaked · A platform was breached · Someone left the team
python3 -m unittest discover -s tests
REKEY_TEST_CLIPBOARD=1 python3 -m unittest discover -s tests -p test_interactive.py # drives a real terminal (macOS, uses the clipboard)MIT License