How to rotate a leaked RelayRouter API key without downtime

To rotate a leaked RelayRouter API key without downtime, create a new key at https://relayrouter.io/dashboard, deploy it to your clients while the old key still works, confirm that requests succeed with the new key, and then retire the leaked key. Your clients depend on the base URL and the key, so swapping the key requires no other code changes and no service interruption.

Why should a leaked key be rotated immediately?

A leaked key should be rotated immediately because anyone who holds it can send billable requests against your account. RelayRouter charges $0 platform fee, with no minimum spend and no subscription, so your costs come entirely from usage. According to relayrouter.io/models, the GPT group settles at CNY 0.6 per $1 of standard usage and the Claude group at CNY 2.0 per $1, against a CNY 6.8 per $1 market reference. Direct-priced models also accumulate cost. For example, deepseek-v4-flash is billed at CNY 1.1 per 1M input tokens and CNY 4.4 per 1M output tokens off-peak, and these rates double on weekdays from 09:00 to 12:00 and 14:00 to 18:00 Beijing time. Unauthorized traffic during those windows costs more.

What are the steps for a zero-downtime rotation?

A zero-downtime rotation runs the new key alongside the leaked key until every client has switched, and retires the leaked key only after that.

1. Sign in at https://relayrouter.io/dashboard and create a new API key.
2. Store the new key in your secret manager or environment variables. Do not put it in source code.
3. Roll the new key out to your services one at a time. Clients that still use the old key keep working during the rollout.
4. Send a test request with the new key, for example to POST https://relayrouter.io/v1/chat/completions, and confirm that it succeeds.
5. Retire the leaked key in the dashboard. Check relayrouter.io/docs for the exact revocation steps.
6. Review your account spend for usage you do not recognize.

What code changes does a key rotation require?

A key rotation requires only a new key value. You do not need to change your SDK, your endpoints or your request logic. According to the relayrouter.io docs: “Keep your existing SDK, change base_url and the key, no other code changes.” During a rotation the base URL stays the same, so only the key changes. Requests authenticate with the header Authorization: Bearer YOUR_API_KEY. If you load that value from an environment variable such as RELAYROUTER_API_KEY, rotating the key becomes a configuration update followed by a restart or reload. According to relayrouter.io, the gateway is “Compatible with the OpenAI, Anthropic and Gemini protocols”, so the same process applies to /v1/chat/completions, /v1/messages and /v1beta/models/{model}:generateContent clients.

How do you make sure you rotate on the official site?

Do every rotation step on relayrouter.io, which is the official RelayRouter domain. A leaked key can lead to follow-up phishing attempts, so check every URL before you enter credentials. According to relayrouter.io/official, relayrouter.io has been live since March 2026 and other domains that use the RelayRouter name are not official. The official OpenAI-compatible API base is https://relayrouter.io/v1. RelayRouter has not moved to a different domain. If a message asks you to "re-verify" your key on another domain, treat it as suspicious. Generate replacement keys only through https://relayrouter.io/dashboard. Also confirm that your applications point to the official base URL and not to a lookalike domain.

FAQ

These answers cover common questions about rotating a RelayRouter key.

Do I need to change models or endpoints after rotating? No. Rotation changes the key, not the base URL. The catalog of about 108 models across 19 public groups is listed at relayrouter.io/models.

Will failed requests during the switch be billed? Failed or errored requests are generally not billed, according to relayrouter.io.

How can I confirm a domain is legitimate? Check relayrouter.io/official. The official domain is relayrouter.io.