Replace a service’s credentials when updating application secrets or responding to exposure. Prepare dependent applications first: PD Object Storage rotation behaves differently across its backends.

Prepare the affected tools

Identify the intended service and the backup jobs, sync tools and applications using it. Arrange a suitable interruption window and note its current access state. The host’s provider credential is separate from the customer service credential being rotated.

Use Show or Copy in Connection details to redisplay a saved secret. Rotation is unnecessary for that task.

Rotate once and use the returned pair

1. Open the intended service’s Connection details.
2. Choose Rotate credentials and read the confirmation.
3. Complete the operation once and inspect its result.
4. Save the returned access key and secret privately.
5. Update every dependent application and verify its required operations.
6. Inspect Activity for the original result.

AWS and Spaces replace both access key and secret. R2 and MinIO can retain the access-key identity while changing its secret. Always use the complete returned details rather than assuming an unchanged ID means the old secret still works.

Handle interruption and old links

Do not assume the old credential remains usable throughout replacement. Spaces removes old matching keys before creating its replacement; a failed change can leave access needing administrator attention. No backend should be treated as a guaranteed uninterrupted switch.

Signed links can stop working before their displayed expiry when the signing credential changes. Replace links where necessary and distribute them privately.

If a request fails or times out, inspect the current service and original result before repeating rotation. It does not remove suspension, fix a failed permission transition or recover deleted objects.

See the PD Object Storage WHMCS guide for related tasks, or explore PD Object Storage.