A terminal key is a durable credential — anyone holding it can act on the bound terminal within your subscription's capabilities until you revoke it. That makes rotating and revoking keys worth knowing cold, both for routine hygiene and for the day one leaks.
Rotate without downtime
When you want to swap a key without interrupting anything, generate the new one first and retire the old one last:
- Generate a new key in Dashboard → Terminal Keys → Generate New Key.
- Update your client (and/or EA) configuration to use the new key.
- Verify with a read-only prompt — "What's the EURUSD price?" (
get_tick) or "What's my balance?" (get_account_info). - Once the new key works, revoke the previous key.
Doing it in that order means there's never a moment where no valid key is in place.
Revoke immediately on a suspected leak
If a key may have been exposed, reverse the order — safety first:
- Revoke the exposed key from Dashboard → Terminal Keys right away. The server stops issuing new sessions for it within seconds.
- Then generate a new key and deploy it.
What happens to sessions already running
Revocation stops new sessions immediately, but a session token that's already been issued keeps working until it expires (by default within an hour) and then fails to refresh. So a live MCP session may keep functioning for a short window after you revoke — this is expected. For a true emergency, revoking is still the right move; the blast radius closes as the cached session token lapses. (See Session tokens: getting and rotating your JWT for how that token lifecycle works.)
Notes and gotchas
- The plaintext key is shown once at creation. If you lose it, you can't reveal it again — generate a new one and rebind.
- A new key must be bound by letting a terminal connect with it once before it works in a client (see Activating your license key).
- Revoking a key doesn't free a terminal seat the way you might expect if you're at your seat cap — see Terminal seats: PRO vs TEAM.
Next steps
For the broader hygiene picture, see Keeping your terminal key and JWT safe. If a client suddenly stops authenticating, see Auth errors and expired tokens.