# Diagnosis

## Symptom

Requests that worked yesterday now return 401 across one or more services, following a key rotation in the console.

## Likely cause

Rotation is instant and there is no grace period: the old key dies everywhere at once, and any consumer not updated 401s.

## Confirm it

1. Confirm the timeline: did the 401s start when the new key was issued?
2. Inventory key consumers: CI secrets, hosting provider env vars, local .env files, teammates' machines, scheduled jobs.
3. For each, check whether it holds the old or new value (compare fingerprints or last-updated timestamps, never paste values into chat).

## Fix

1. Update every consumer to the new key in one pass.
2. Name keys by use (`ci-prod`, `local-dev`) so the next rotation has an inventory to work from.
3. Prefer per-context keys so rotating one context never takes down the others.

## Verify the fix

Hit a cheap read (list_indexes or describe_index_stats) from each consumer after updating; all green before closing the incident.