How to rotate a ClearRun API key

Create a new key, put it everywhere the old one is used, check that it works, then revoke the old key on the API keys page. Revoking takes effect right away, so switch first.

Last updated

Steps

  1. Create a new key

    At api.clearrun.net/account/keys, choose Create API key and copy it. It is shown only once. See How to create a ClearRun API key.

  2. Replace the old key

    Update CLEARRUN_API_KEY in your environments and CI secrets, and any MCP config. On your own computer, run npx @clearrun/cli login again and paste the new key.

  3. Check the new key

    npx @clearrun/cli score --text "A short test answer."

    This is a real scored call and uses credits.

  4. Revoke the old key

    On the API keys page, choose Revoke next to the old key. Anything still using it gets 401 { "error": "Unauthorized" } from then on. See How to revoke a ClearRun API key.

Find what still uses the old key

Before you revoke, open Usage history on the billing page. Each paid call shows which key made it.