Rotate a service’s storage credentials when replacing a secret or responding to its exposure. Plan the application updates first: tools still using the previous secret will lose access.

Identify every dependent tool

Open the intended customer service and confirm its bucket and current access mode. List the backup applications, sync jobs and other tools using that service credential. Record where their secrets need updating without copying those secrets into tickets or general notes.

Rotation changes authentication; it does not copy objects, move a bucket or remove suspension. A host account-token replacement is a separate operation from rotating one customer service’s storage credentials.

Rotate and update the connections

1. Open the service’s Connection details and choose its credential rotation action.
2. Review the confirmation and complete it once.
3. Save the returned current connection details privately.
4. Update all dependent tools with the returned values.
5. Verify the intended read and write operations and inspect the result in Activity.

R2 rotation can keep the same access key ID while replacing its secret. Copy the returned details rather than assuming that an unchanged ID means no change occurred. The previous secret stops authenticating once the provider change takes effect.

Review links and failures

Previously issued presigned URLs can stop working before their displayed expiry when the signing credential changes. Create replacement links only where they are still needed and share them privately.

If the result is uncertain, inspect the operation and current service state before repeating rotation. Compare the original action with its reported result; keep old and new secrets private. Use the connection guide to check endpoint and application settings independently.

See the PD Cloudflare R2 WHMCS guide for related tasks, or explore the module.