Pinecone diagnosis: 401s start after an API key rotation

Not specified by the original author.

Diagnosis

Symptom

Requests that worked yesterday now return 401 across one or more services, following a key rotation in the console.

Likely cause

Rotation is instant and there is no grace period: the old key dies everywhere at once, and any consumer not updated 401s.

Confirm it

1. Confirm the timeline: did the 401s start when the new key was issued?
2. Inventory key consumers: CI secrets, hosting provider env vars, local .env files, teammates' machines, scheduled jobs.
3. For each, check whether it holds the old or new value (compare fingerprints or last-updated timestamps, never paste values into chat).

Fix

1. Update every consumer to the new key in one pass.
2. Name keys by use (ci-prod, local-dev) so the next rotation has an inventory to work from.
3. Prefer per-context keys so rotating one context never takes down the others.

Verify the fix

Hit a cheap read (listindexes or describeindex_stats) from each consumer after updating; all green before closing the incident.

Pinecone's error-handling guide defines 401 as missing or invalid key; the manage-api-keys guide covers console key lifecycle. Verified against live docs 2026-09-26.