"How do I rotate a production API token?"
Generate the replacement token in the Vault dashboard (Settings → Tokens → Rotate). The old token stays valid for 24h to avoid downtime. Update the value in 1Password under `prod/api-keys`, then trigger the `deploy:tokens` workflow — it patches all running services in <90s.
Grounded in
- Postgres connection pooling — incident retroEngineering · Doc
- RFC-0184 · Event bus deprecationEngineering · GitHub
- Onboarding 2.0 — checklist redesignPeople Ops · Doc