MAINTENANCE

How to Rotate or Replace Your IndexNow API Key

Replacing an IndexNow key is straightforward there is no deregistration or invalidation step. You simply generate a new key, host the new key file, and start using the new key in submissions.

Important: IndexNow has no central registry. You cannot "revoke" a key you simply stop using it and remove the key file from your server. Search engines that cached the old key will fail verification on the next submission, which is harmless.

Key Rotation Steps

Generate a new key

Use our key generator or generate cryptographically with openssl rand -hex 16. Save the new key securely.

openssl rand -hex 16 # → e91b3a2c5f8d4e7a9b0c1d2e3f4a5b6c

Create the new key file

Create a file named {new-key}.txt with the key as its contents (no newline, no extra characters).

echo -n "e91b3a2c5f8d4e7a9b0c1d2e3f4a5b6c" > e91b3a2c5f8d4e7a9b0c1d2e3f4a5b6c.txt

Upload the new key file before updating your code

Upload the new key file to your server first. Do not update your environment variables yet. This prevents a gap where submissions reference a key file that doesn't exist.

# Verify before proceeding: curl https://yourdomain.com/e91b3a2c5f8d4e7a9b0c1d2e3f4a5b6c.txt # Must return: e91b3a2c5f8d4e7a9b0c1d2e3f4a5b6c

Update your environment variables and deploy

Update INDEXNOW_KEY in your .env.local (and in your hosting platform's env settings), then redeploy.

# .env.local update this value: INDEXNOW_KEY=e91b3a2c5f8d4e7a9b0c1d2e3f4a5b6c

Test a submission with the new key

Submit a single URL and verify the response is 200 OK.

curl "https://api.indexnow.org/indexnow?url=https://yourdomain.com/&key=e91b3a2c5f8d4e7a9b0c1d2e3f4a5b6c" # Expected: 200 (empty body)

Remove the old key file

Once the new key is confirmed working, delete the old key file from your server to prevent misuse.

rm d47a82bc1e9f4a3b8c2d5e6f7a8b9c0d.txt

Generate New Key Security Best Practices