Replace a customer storage key pair through PD DigitalOcean Spaces when updating application credentials or responding to an exposed secret. Prepare dependent tools before starting: both the access key and secret change.

Prepare the change

Identify the intended service and the backup jobs, sync tools and applications using its credentials. Arrange a suitable interruption window and establish the current access state. The host’s Personal Access Token is a separate administrative credential.

The connection dialog already provides Show and Copy for the saved secret. Do not rotate just to redisplay it.

Rotate and update applications

1. Open the intended service’s Connection details.
2. Choose Rotate credentials and read the confirmation.
3. Complete the operation once and inspect its result.
4. Save the newly returned access key and secret privately.
5. Update every dependent application with the complete new pair.
6. Verify the required operations and inspect Activity.

Do not assume the old key remains usable while the replacement is being created. A failed replacement can interrupt access and needs investigation; rotation is not a guaranteed uninterrupted switch. It keeps stored objects, but does not repair a failed provisioning operation or remove suspension.

Check links and uncertain results

Signed links made with an old key can stop working before their displayed expiry after credentials are replaced. Issue new links where needed and distribute them privately.

If the request fails or times out, inspect the current service and original result before another rotation. Do not assume an error restored the previous key pair. Your hosting team should retain the service reference, original action time and exact redacted error while your DigitalOcean administrator checks which matching key actually remains. Exclude both key pairs and private object links from shared evidence.

Check the updated credentials

Your hosting team and DigitalOcean administrator should compare the original rotation result, currently saved service credentials and actual matching native keys before another attempt. Old same-named keys are deleted before the replacement is issued, so a failure can leave applications without a usable pair. Check dependent tools and old signed links separately; changing a host token or repeatedly rotating is not a repair for a different access restriction. Never include either key pair.

See the PD DigitalOcean Spaces WHMCS guide for related tasks, or explore the module.