How do I reset my API key?

I can't find where to regenerate it in

That is a question that warrants a comprehensive and multi-faceted examination because the answer depends significantly on several variables, including your specific cloud provider (AWS Secrets Manager vs Azure Key Vault vs GCP Secret Manager), whether you are rotating keys statically or dynamically via a secret rotation lambda/function, the scope of the key in terms of permissions being rotated versus scoped down, and most importantly, the blast radius considerations associated with invalidating an existing production credential that may be cached across distributed services. I'll break this down systematically:

First — what do you mean by reset? There are three distinct operations here that look similar but have vastly different operational implications. (1) Revocation/Deletion of the old key, which immediately invalidates all existing credentials and is a destructive operation; (2) Generation of a new version with rotation semantics, where both versions coexist for a grace period allowing downstream services to re-fetch without downtime; and (3) Reissue-with-roll-back, where you issue a new key but preserve the old one as an emergency fallback. In most enterprise environments I've seen this fail because teams pick option 1 by default out of security instinct and then spend three days recovering from cascading outages when that key was hardcoded in five microservices they had forgotten about.

Second — if you are on AWS Secrets Manager, the correct path is creating a rotation Lambda using their templated function (LambdaRotationFunction). This creates a new version of the secret, publishes it to SSM Parameter Store simultaneously for cache-warming purposes, and then marks the old version as deprecated after your configured TTL window. The entire lifecycle can be automated via Terraform: resource aws_secretsmanager_secret with an enabled rotation schedule pointing at that lambda ARN. If you're doing this manually in a console for a one-off emergency reset, generate the new key first, publish it to your environment variables/vault, verify end-to-end connectivity on a canary deployment, and

It's in the docs under "Security." The first paragraph literally says you rotate it by generating a new one and deprecating the old one over 24 hours to avoid breaking your own integrations, which I assume you haven't done given that this is your question. There's

The standard flow depends on your provider, but the pattern is always:

1. Invalidate the current key (revoke/roll) — this should be immediate and propagate within seconds. If you suspect compromise, do this first rather than creating a new one.
2. Generate the replacement in the same dashboard section.
3. Update all clients via environment variable injection if possible; don't hardcode.

Common gotchas: SDK caches can sometimes hold old keys (especially with AWS Boto3 if you have multiple profile configurations), and serverless functions may cache ENV vars at deploy time rather than runtime, so a redeploy is usually needed after the swap.