golbin / rekey

**English** · 한국어 · 中文 · 日本語 · Español
# rekey
Reissue an API key with one command, update it everywhere it is used (.env files, Vercel, Railway, Supabase, GCP, GitHub…), and revoke the old one.
 [code] 
- **Finds the keys you forgot.** `rekey init` doesn't rely on memory: it reads every .env file and Vercel, Railway, Supabase and GCP themselves, and groups identical values, so a key copied into twenty places, including a project nobody remembers, becomes one entry. For places it can't read (a teammate's laptop, a third-party dashboard), add one template line once and it is never forgotten again.
- You don't need to know each service. Keys that can be issued by API are handled automatically; for the rest, rekey opens the right page and you just make the key and **copy** it.
- Key values never appear on screen. They live only in 1Password.
- Python 3.11+, standard library only.
- Messages follow your system language (English, 한국어, 中文, 日本語, Español). Set `REKEY_LANG=en` to choose.
## How it works
| What | Where |
|---|---|
| Key values | 1Password: one vault per environment (`Acme - Prod`, `Acme - Dev`, `Acme - Local`), one item per key, named ` . ` |
| Where each key is used, plus plain settings | `targets/ /**.tpl` in your team's private repo |
| Exceptions (locked, tags, notes) | `keys.toml` in your team's private repo |
Templates use 1Password's own syntax, and the file path says where the values go.
 [code] 
## Guides
0. Example team data: see what it looks like, then **Use this template**
1. Setup: 10 minutes
2. Usage
3. Situations: A key leaked · A platform was breached · Someone left the team
## Development
 [code] 
MIT License