Replacing an exposed API key introduces a critical tension between security and uptime. Simply generating and saving a new key is insufficient — the provider must actively revoke the old credential, and the running application must be updated to use the replacement. Any overlap between the old and new keys leaves an exposure window that attackers can exploit.