# When and how to rotate a feedback widget key > Rotate an Escuta Produto product key when someone is abusing it, when a private configuration that held it may have leaked, or when a team member who had access to it leaves. The old key stops working at once, so rotate, deploy the new snippet and check a test submission in one short window. Source: https://escutaproduto.com/resources/rotate-product-key Last updated: 2026-10-11 ## Is the widget key a secret? No. The key sits in the widget snippet, which is part of your page source, so every visitor can read it. It is designed to be public. A key can only create feedback, never read it, so a stranger who copies it cannot see your inbox, your customers or your notes. That changes how you think about rotation. You do not rotate a key the way you rotate a password after a breach. You rotate it when the key is being used in a way you do not want, most often as a stream of spam or abusive submissions, or when it sits in a private place that people you no longer trust could reach. Rotation is a way to cut off every client that uses the old key at once. ## When is rotating a key the right move? Rotate when one of these is true: - Submissions are arriving in volume from a source you do not recognize, and the origin list and rate limit have not stopped them. - The key appeared in a private place where it does not belong, such as a shared document or a support thread, and you cannot tell who saw it. - A contractor or former team member had access to the key through a repository, an environment file or a mobile build, and you want to be sure old copies stop working. Do not rotate just because someone left the company. If the key only ever appeared in public page source, a rotation adds work without reducing any risk. Check the dashboard first, then decide. ## How does rotation work, step by step? Rotation is a single action in the product settings. Open the product, go to its settings, and choose rotate key. Escuta Produto replaces the key with a new one immediately, and the old value is no longer accepted. There is no overlap period, so plan the window before you press the button: 1. Prepare the new snippet or the new value for your REST calls in your code, ready to deploy. 2. Rotate the key in the product settings and copy the new value. 3. Put the new value in the snippet, the mobile build or the server config, and deploy. 4. Send a test submission from the live site and check that it appears in the inbox. Between steps 2 and 3, every client still using the old key gets an error. Keep that gap as short as you can by preparing the change before you rotate. ## What breaks while the old key is gone? Anything still sending the old key fails with a 404 response that says the project key is unknown. For the widget, the form sends nothing until the site is updated and deployed. For a mobile app, older app versions keep sending the old key until users install an update, so their feedback fails for as long as they keep those versions. For example, suppose a mobile app has 3 versions in the field and the oldest is still used by a few customers. Rotating the key would stop submissions from that version until its users upgrade. If that is unacceptable, rotate when the app's usage is lowest, or wait until the old version has been retired. Check the status code in your own logs, too. A sudden run of 404 responses after a rotation usually means a client was missed, and the fastest fix is to find that client and deploy the new key. ## What do allowed origins and rate limits actually stop? Allowed origins are a filter for browsers. When the list is not empty, a request that carries an Origin header from a site not on the list gets a 403 response. That stops a random website from using your key in a visitor's browser. It does not stop a script on a server, and any client can set the Origin header to any value, so treat the list as a filter rather than a lock. Rate limiting works alongside it. Escuta Produto allows 10 submissions per minute per IP address and product, and returns a 429 response past that. A honeypot field and size limits catch simple bots. Together, these reduce casual abuse, but they do not replace rotation when a key is being used in earnest. Rotation is the control that actually stops a client holding the old key. ## How do you confirm the new key works? Run two checks after the rotation. The first confirms the old key is dead. Send a test request with the old value and expect a 404: ```bash curl -i -X POST https://escutaproduto.com/api/v1/feedback \ -H "Content-Type: application/json" \ -d '{"key":"pk_old_key","message":"Test after rotation"}' ``` The second confirms the new key works. Submit a real test item from the live site, then check the product's inbox and the Slack or Discord alert. If both appear, the rotation is complete. Write the date in your notes, so the next person who asks why the key changed has a record. ## Rotating a key in Escuta Produto settings The rotate action lives on the product's settings page, next to the notification webhook and the allowed origins. Use those fields together. Keep the origin list tight, confirm the webhook still points to the right channel after any change, and then rotate only if the reason in the first section applies. The [widget guide](/docs/widget) shows the snippet to update, and the [API reference](/docs/api) covers the key field for mobile and server clients. For a broader view of how to protect a product's feedback over time, read [the feedback widget best practices guide](/resources/feedback-widget-best-practices). If the key you rotated belongs to a product you are still setting up, [adding a new product to your feedback routine](/resources/add-new-product-to-feedback-routine) walks through the allowed origins step in the right order, so the new key arrives on a site that will accept it. ## Frequently asked questions ### Is the Escuta Produto widget key a secret I must protect? No. The key appears in the page source, so it is public by design. It can only create feedback and cannot read the inbox. Rotate it when it is being abused or when a private place that held it may have leaked, not as a routine step. ### What happens to the old key after I rotate it? It stops working immediately, with no overlap period. Requests that still send it receive a 404 response saying the project key is unknown, so update the widget snippet, mobile build or server config and deploy as soon as you rotate. ### Do allowed origins stop someone who has my key? Not fully. Allowed origins filter requests coming from other websites in a browser, but any client can set the Origin header. Rate limiting helps against casual abuse, and rotating the key is the control that cuts off a client that holds the old value.