Features

This chapter covers the core features and capabilities of Secret Rotator.

Features

• Automated rotation — rotate secrets based on configurable max-age policies (default: 90 days)
• Provider hooks — built-in support for Stripe, generic API keys, and password generation
• Rollback on failure — automatic backup and restore if rotation fails
• Age checking — scan all secrets and flag stale credentials with --check-age
• Secure backups — HMAC-verified backup before every rotation
• Cryptographic generation — secrets generated via Python's secrets module (CSPRNG)
• JSON config-driven — define all secrets and policies in a single config file
• Audit trail — rotation events logged for compliance and debugging

Requirements

• Python 3.10+
• No external dependencies (stdlib only)

Quick Start

Follow this guide to get Secret Rotator up and running in your environment.

Quick Start

# Rotate all secrets that exceed their max age
python src/secret_rotator.py --config secrets.json --rotate

# Check which secrets are stale
python src/secret_rotator.py --config secrets.json --check-age

# Roll back a specific secret to its previous value
python src/secret_rotator.py --config secrets.json --rollback api-key-prod

Output

Console output shows rotation status per secret (rotated, skipped, failed, rolled back). The config file is updated in place with new values and timestamps.