**TL;DR:** Symptom: everything 401s right after rotating a key. Some deployment still holds the old key; inventory every consumer and update them together. Confirm it 1. Confirm the timeline: did the 401s start when the new key was issued?

## The fix

1. Confirm the timeline: did the 401s start when the new key was issued?

2. Inventory key consumers: CI secrets, hosting provider env vars, local .env files, teammates' machines, scheduled jobs.

3. For each, check whether it holds the old or new value (compare fingerprints or last-updated timestamps, never paste values into chat).

4. Update every consumer to the new key in one pass.

5. Name keys by use (`ci-prod`, `local-dev`) so the next rotation has an inventory to work from.

6. Prefer per-context keys so rotating one context never takes down the others.

## When to use this

- This covers exactly what the title says: Pinecone diagnosis.
- You are setting this up for the first time, or auditing an existing setup.
- You want the key gotchas in one place before you start.

## When not to use this

- You are doing a different workflow with Pinecone; these steps are specific to the title above.
- You need the full reference docs; this is the short path, not the manual.

## Compatibility

- Not pinned to a specific version; follows current Pinecone behavior.