# Diagnosis
## Symptom
Requests that worked yesterday now return 401 across one or more services, following a key rotation in the console.
## Likely cause
Rotation is instant and there is no grace period: the old key dies everywhere at once, and any consumer not updated 401s.
## Confirm it
1. Confirm the timeline: did the 401s start when the new key was issued?
2. Inventory key consumers: CI secrets, hosting provider env vars, local .env files, teammates' machines, scheduled jobs.
3. For each, check whether it holds the old or new value (compare fingerprints or last-updated timestamps, never paste values into chat).
## Fix
1. Update every consumer to the new key in one pass.
2. Name keys by use (`ci-prod`, `local-dev`) so the next rotation has an inventory to work from.
3. Prefer per-context keys so rotating one context never takes down the others.
## Verify the fix
Hit a cheap read (list_indexes or describe_index_stats) from each consumer after updating; all green before closing the incident.