Rotate a secret without breaking the work

A secret that never changes only has to leak once. Rotation limits how long a leaked value is useful, but a rotation done in one step drops every run that is still holding the old value.

Accept two versions during the changeover

Issue the new value and let both the old and the new be accepted for a while. Callers pick up the new value at their own pace, and nothing mid flight is cut off.

Rotate on a schedule

Rotation that only happens after an incident is a reaction to a leak, not a guard against one. Put it on a schedule and alert when a secret ages past its due date.

def due(secret, now):
    age = (now - secret.issued).days
    return age >= secret.rotation_days

Retire the old value only after proof

Keep the old value working until the new one is proven in use. Retiring it at the same instant as the issue is what breaks the work, not the rotation itself.