# Ensure user active API key is rotated within 90 days or less

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698515644354-ensure-user-active-api-key-is-rotated-within-90-days-or-less
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure every active API signing key belonging to an IAM user was created within the last 90 days. API keys are used by the OCI CLI, SDKs, and automation to sign requests, so they should be replaced regularly and the old key removed after the switch.

**Rationale**

API keys remain valid until they are deleted. A private key that is never replaced may be copied to many machines, repositories, or CI systems over time, and anyone who obtains it can act as that user. Rotating keys at least every 90 days limits how long a leaked key can be used and forces a regular review of where keys are stored.

**Impact**

-   Limits how long a leaked API key can be used
    
-   Encourages review of where keys are stored
    
-   Tools using the old key must be updated
    

**Default Value**

By default, API keys do not expire, and each user can have up to three API keys.

**Pre-Requisites**

-   Identity domain administrator or user administrator role, or the user themselves
    
-   A list of tools and machines that use each key
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the User management tab, and select the user you want to review.
    
4.  Open the Tokens and keys tab and find the API keys section (on older consoles, select API keys under Resources).
    
5.  Check the creation date of each key.
    
6.  If any active key is older than 90 days, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the User management tab, and select the user you want to review.
    
4.  Open the Tokens and keys tab, and in the API keys section select Add API key.
    
5.  Generate or upload a new key pair and select Add.
    
6.  Update the OCI CLI configuration and every tool that uses the old key with the new key and fingerprint.
    
7.  Delete the old API key.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the User management tab, and select the user you want to review.
    
4.  If a tool fails, add another new API key and update the tool with it.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.