From 1717d608dfe8c4383c3e1781521e0fb4e61faf73 Mon Sep 17 00:00:00 2001
From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com>
Date: Thu, 22 Oct 2026 10:13:37 +0000
Subject: [PATCH 1/2] docs: document revoking the previous root key on
 regeneration

---
 docs/apikeys.mdx | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/docs/apikeys.mdx b/docs/apikeys.mdx
index 694fde36583..42b4aada266 100644
--- a/docs/apikeys.mdx
+++ b/docs/apikeys.mdx
@@ -118,6 +118,13 @@ Revoking a key takes effect immediately and cannot be reversed. Requests using t
 
 Removing a team member does not revoke keys they created. Review and revoke their keys separately when their access changes.
 
+### Regenerate the root key
+
+The key marked **Root** on the API keys page has a **Regenerate…** action in its row menu. Regenerating issues a new root key for the environment, and you choose what happens to the previous one:
+
+- **Keep the previous key working for 24 hours** (the default): roll out the new key to your environment variables without downtime. The previous key stops working after 24 hours.
+- **Revoke the previous key immediately**: choose this if the key may have leaked. Deployments and services still using the previous key fail until you update them with the new key.
+
 ## Create public access tokens
 
 API keys can be used to create scoped [Public Access Tokens](/realtime/auth) using `auth.createPublicToken()`.

From 89b899a147349688c740e0b387897f4116829704 Mon Sep 17 00:00:00 2001
From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com>
Date: Fri, 23 Oct 2026 10:09:27 +0000
Subject: [PATCH 2/2] docs: cover masked hidden root keys and revoking keys in
 their grace window

---
 docs/apikeys.mdx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/docs/apikeys.mdx b/docs/apikeys.mdx
index 42b4aada266..88584aaa9d6 100644
--- a/docs/apikeys.mdx
+++ b/docs/apikeys.mdx
@@ -123,7 +123,9 @@ Removing a team member does not revoke keys they created. Review and revoke thei
 The key marked **Root** on the API keys page has a **Regenerate…** action in its row menu. Regenerating issues a new root key for the environment, and you choose what happens to the previous one:
 
 - **Keep the previous key working for 24 hours** (the default): roll out the new key to your environment variables without downtime. The previous key stops working after 24 hours.
-- **Revoke the previous key immediately**: choose this if the key may have leaked. Deployments and services still using the previous key fail until you update them with the new key.
+- **Revoke the previous key immediately**: choose this if the key may have leaked. The previous key stops working now, along with any older root key still in its 24-hour window. Deployments and services still using them fail until you update them with the new key.
+
+The page always lists the root key. If the root key is hidden, it appears masked to its last 4 characters. You can regenerate a hidden root key, but you can't reveal or copy it.
 
 ## Create public access tokens