@@ -0,0 +1,6 @@
+---
+area: webapp
+type: feature
+---
+
+When regenerating an environment's API key you can now revoke the previous key immediately instead of keeping it working for 24 hours. Use this when a key may have leaked.
@@ -11,6 +11,7 @@ import { Input } from "../primitives/Input";
 import { InputGroup } from "../primitives/InputGroup";
 import { Paragraph } from "../primitives/Paragraph";
 import { CheckboxWithLabel } from "../primitives/Checkbox";
+import { RadioGroup, RadioGroupItem } from "../primitives/RadioButton";
 import { Spinner } from "../primitives/Spinner";
 
 type ModalProps = {
@@ -75,16 +76,32 @@ const RegenerateApiKeyModalContent = ({
   return (
     <div className="flex flex-col items-center gap-y-4 pt-4">
       <Callout variant="warning">
-        {`A new API key will be issued for the ${title} environment. The previous key stays valid
-        for 24 hours so you can roll out the new key in your environment variables without downtime.
-        After 24 hours, the previous key stops working.`}
+        {`A new API key will be issued for the ${title} environment. Choose what happens to the previous key.`}
       </Callout>
       <fetcher.Form
         method="post"
         action={`/resources/environments/${id}/regenerate-api-key`}
         className="mt-2 w-full"
       >
         <Fieldset className="w-full">
+          <InputGroup className="max-w-full">
+            <RadioGroup name="previousKey" defaultValue="grace" className="flex flex-col gap-2">
+              <RadioGroupItem
+                id="previousKey-grace"
+                value="grace"
+                variant="description"
+                label="Keep the previous key working for 24 hours"
+                description="Roll out the new key to your environment variables without downtime. The previous key stops working after 24 hours."
+              />
+              <RadioGroupItem
+                id="previousKey-revoke"
+                value="revoke"
+                variant="description"
+                label="Revoke the previous key immediately"
+                description="Choose this if the key may have leaked. Deployments and services still using the previous key will fail until they are updated with the new key."
+              />
+            </RadioGroup>
+          </InputGroup>
           <InputGroup className="max-w-full">
             <Paragraph variant="small/bright">Enter this text below to confirm:</Paragraph>
             <Paragraph
 
@@ -25,6 +25,10 @@ type RootApiKeyMutationInput = {
   environmentId: string;
 };
 
+type RegenerateApiKeyInput = RootApiKeyMutationInput & {
+  revokeImmediately?: boolean;
+};
+
 export class RootApiKeyNotVisibleError extends Error {
   constructor() {
     super("The root API key is no longer visible");
@@ -110,7 +114,7 @@ async function lockVisibleRootApiKeyEnvironment(
 }
 
 export async function regenerateApiKey(
-  input: RootApiKeyMutationInput,
+  { revokeImmediately = false, ...input }: RegenerateApiKeyInput,
   { prismaClient = prisma }: { prismaClient?: PrismaClient } = {}
 ) {
   const environment = await findRootApiKeyEnvironment(input, prismaClient);
@@ -132,13 +136,15 @@ export async function regenerateApiKey(
         },
       });
 
-      await tx.revokedApiKey.create({
-        data: {
-          apiKey: currentEnvironment.apiKey,
-          runtimeEnvironmentId: environment.id,
-          expiresAt: revokedApiKeyExpiresAt,
-        },
-      });
+      if (!revokeImmediately) {
+        await tx.revokedApiKey.create({
+          data: {
+            apiKey: currentEnvironment.apiKey,
+            runtimeEnvironmentId: environment.id,
+            expiresAt: revokedApiKeyExpiresAt,
+          },
+        });
+      }
 
       return { ...environment, apiKey: newApiKey, pkApiKey: newPkApiKey };
     }
 
@@ -14,6 +14,10 @@ const ParamsSchema = z.object({
   env: z.enum(["dev", "staging", "prod", "preview"]),
 });
 
+const BodySchema = z.object({
+  revokeImmediately: z.boolean().default(false),
+});
+
 export async function action({ request, params }: ActionFunctionArgs) {
   if (request.method.toUpperCase() !== "POST") {
     return json({ error: "Method Not Allowed" }, { status: 405 });
@@ -42,6 +46,24 @@ export async function action({ request, params }: ActionFunctionArgs) {
       return json({ error: "Branch-scoped key rotation is not supported" }, { status: 400 });
     }
 
+    const rawBody = await request.text();
+    let body: unknown = {};
+    if (rawBody.trim().length > 0) {
+      try {
+        body = JSON.parse(rawBody);
+      } catch {
+        return json({ error: "Invalid JSON body" }, { status: 400 });
+      }
+    }
+
+    const parsedBody = BodySchema.safeParse(body);
+
+    if (!parsedBody.success) {
+      return json({ error: "Invalid Body" }, { status: 400 });
+    }
+
+    const { revokeImmediately } = parsedBody.data;
+
     const environment = await authenticatedEnvironmentForAuthentication(
       authenticationResult,
       projectRef,
@@ -65,6 +87,7 @@ export async function action({ request, params }: ActionFunctionArgs) {
     const updatedEnvironment = await regenerateApiKey({
       userId: authenticationResult.result.userId,
       environmentId: environment.id,
+      revokeImmediately,
     });
 
     return json({ apiKey: updatedEnvironment.apiKey });
 
@@ -52,9 +52,14 @@ export const action = dashboardAction(
 
     const formData = await request.formData();
     const syncToVercel = formData.get("syncToVercel") === "on";
+    const revokeImmediately = formData.get("previousKey") === "revoke";
 
     try {
-      const updatedEnvironment = await regenerateApiKey({ userId: user.id, environmentId });
+      const updatedEnvironment = await regenerateApiKey({
+        userId: user.id,
+        environmentId,
+        revokeImmediately,
+      });
 
       // Sync the regenerated API key to Vercel only when requested and not for DEVELOPMENT
       if (syncToVercel && updatedEnvironment.type !== "DEVELOPMENT") {
 
@@ -38,7 +38,9 @@ export async function seedTestUserProject(
       isActivated: true,
       members: { create: { userId: user.id, role: "ADMIN" } },
     },
+    include: { members: true },
   });
+  const orgMember = organization.members[0];
 
   const project = await prisma.project.create({
     data: {
@@ -60,6 +62,7 @@ export async function seedTestUserProject(
       shortcode: suffix.slice(0, 4),
       projectId: project.id,
       organizationId: organization.id,
+      orgMemberId: orgMember.id,
     },
   });
 
 
@@ -0,0 +1,70 @@
+import { containerTest } from "@internal/testcontainers";
+import { expect, vi } from "vitest";
+import { regenerateApiKey } from "~/models/api-key.server";
+import { findEnvironmentByApiKey } from "~/models/runtimeEnvironment.server";
+import {
+  createRuntimeEnvironment,
+  createTestOrgProjectWithMember,
+} from "./fixtures/environmentVariablesFixtures";
+
+vi.setConfig({ testTimeout: 60_000 });
+
+containerTest(
+  "regenerating keeps the previous root key valid for a grace period",
+  async ({ prisma }) => {
+    const { organization, project, user } = await createTestOrgProjectWithMember(prisma);
+    const environment = await createRuntimeEnvironment(prisma, {
+      projectId: project.id,
+      organizationId: organization.id,
+      type: "PRODUCTION",
+    });
+    const oldRootApiKey = environment.apiKey;
+
+    const result = await regenerateApiKey(
+      { environmentId: environment.id, userId: user.id },
+      { prismaClient: prisma }
+    );
+
+    expect(result.apiKey).not.toBe(oldRootApiKey);
+    const revoked = await prisma.revokedApiKey.findMany({
+      where: { runtimeEnvironmentId: environment.id },
+    });
+    expect(revoked).toHaveLength(1);
+    expect(revoked[0].apiKey).toBe(oldRootApiKey);
+    expect(revoked[0].expiresAt.getTime()).toBeGreaterThan(Date.now());
+    await expect(findEnvironmentByApiKey(oldRootApiKey, undefined, prisma)).resolves.toMatchObject({
+      id: environment.id,
+    });
+    await expect(findEnvironmentByApiKey(result.apiKey, undefined, prisma)).resolves.toMatchObject({
+      id: environment.id,
+    });
+  }
+);
+
+containerTest(
+  "regenerating with revokeImmediately rejects the previous root key at once",
+  async ({ prisma }) => {
+    const { organization, project, user } = await createTestOrgProjectWithMember(prisma);
+    const environment = await createRuntimeEnvironment(prisma, {
+      projectId: project.id,
+      organizationId: organization.id,
+      type: "PRODUCTION",
+    });
+    const oldRootApiKey = environment.apiKey;
+
+    const result = await regenerateApiKey(
+      { environmentId: environment.id, userId: user.id, revokeImmediately: true },
+      { prismaClient: prisma }
+    );
+
+    expect(result.apiKey).not.toBe(oldRootApiKey);
+    const revoked = await prisma.revokedApiKey.findMany({
+      where: { runtimeEnvironmentId: environment.id },
+    });
+    expect(revoked).toHaveLength(0);
+    await expect(findEnvironmentByApiKey(oldRootApiKey, undefined, prisma)).resolves.toBeNull();
+    await expect(findEnvironmentByApiKey(result.apiKey, undefined, prisma)).resolves.toMatchObject({
+      id: environment.id,
+    });
+  }
+);
@@ -3,7 +3,7 @@ import { getTestServer } from "./helpers/sharedTestServer";
 import { seedTestUserProject } from "./helpers/seedTestUserProject";
 
 describe("regenerate API key branch handling", () => {
-  it.each(["feature", "", "default"])(
+  it.each(["feature", "default"])(
     "rejects a present branch header without rotating the root key (%s)",
     async (branch) => {
       const server = getTestServer();
@@ -53,4 +53,65 @@ describe("regenerate API key branch handling", () => {
     });
     expect(revoked?.expiresAt.getTime()).toBeGreaterThan(Date.now());
   });
+
+  it("revokes the previous key immediately when asked", async () => {
+    const server = getTestServer();
+    const { environment, pat, project } = await seedTestUserProject(server.prisma);
+    const apiKeyRoute = "/api/v1/runs/run_doesnotexist/result";
+
+    const response = await server.webapp.fetch(
+      `/api/v1/projects/${project.externalRef}/dev/regenerate-api-key`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${pat.token}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ revokeImmediately: true }),
+      }
+    );
+
+    expect(response.status).toBe(200);
+    const body = (await response.json()) as { apiKey: string };
+    expect(body.apiKey).not.toBe(environment.apiKey);
+
+    const revoked = await server.prisma.revokedApiKey.findFirst({
+      where: { apiKey: environment.apiKey, runtimeEnvironmentId: environment.id },
+    });
+    expect(revoked).toBeNull();
+
+    const oldKeyResponse = await server.webapp.fetch(apiKeyRoute, {
+      headers: { Authorization: `Bearer ${environment.apiKey}` },
+    });
+    expect(oldKeyResponse.status).toBe(401);
+
+    const newKeyResponse = await server.webapp.fetch(apiKeyRoute, {
+      headers: { Authorization: `Bearer ${body.apiKey}` },
+    });
+    expect(newKeyResponse.status).not.toBe(401);
+  });
+
+  it("rejects a malformed body without rotating the root key", async () => {
+    const server = getTestServer();
+    const { environment, pat, project } = await seedTestUserProject(server.prisma);
+
+    const response = await server.webapp.fetch(
+      `/api/v1/projects/${project.externalRef}/dev/regenerate-api-key`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${pat.token}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ revokeImmediately: "yes" }),
+      }
+    );
+
+    expect(response.status).toBe(400);
+    const persisted = await server.prisma.runtimeEnvironment.findUniqueOrThrow({
+      where: { id: environment.id },
+      select: { apiKey: true },
+    });
+    expect(persisted.apiKey).toBe(environment.apiKey);
+  });
 });