Skip to content

On the deskDesigning zero-downtime API key rotation

Start free

Built to rank.
Built to be cited.

Technical articles that win Google clicks and get cited in AI answers like ChatGPT and Google's AI Overviews. Drafted from your product knowledge, checked against your sources, approved by your team.

Start freeRead a real article →

A stack of three proof sheets for one article, taking turns at the front:

  1. The article: "Designing Zero-Downtime API Key Rotation", written for the target query "api key rotation zero downtime". Its outline runs: the rotation contract; async and queued workloads; comparing rotation strategies; rollback and common mistakes. Source verified, with claims tracing to the product’s own docs across 14 source checks.
  2. The search result: the same article on a results page for "api key rotation zero downtime", listed at cowrite.dev/example under the description "A practical playbook for rotating live API keys without breaking a single client request. Issue, verify, converge, revoke."
  3. The AI answer: asked "How do I rotate API keys without downtime?", an assistant answers "Keep two keys valid for the same principal for a defined window. Issue the new key, verify real traffic on it, wait for old-key traffic to reach zero, then revoke," and names the same article at cowrite.dev/example as source 1.

Built by the maker of mdedit.ai, a writing workspace 9,000+ writers have made part of their workflow.

The old way doesn't get cited.

Six weeks and $1,000+ per agency article.

Days instead of weeks, at a fraction of the cost, every review gate intact.

Fact-check everything after the AI is done.

Every fact checked before a human signs off.

A generic voice like every other AI blog.

Drafts shaped to your brand voice, not a template.

Start from your product, not a blank page.

Paste your product URL. Cowrite reads your pages, docs, blog, and the search results around them, then proposes eight to ten briefs worth writing.

https://yourproduct.dev

What Cowrite reads

  • Product pages
  • Documentation
  • Existing blog
  • SERP and keyword gaps
  • Competitor coverage
  • Your goals

Every brief cites what it was built from.

Brief

Designing zero-downtime API key rotation

rotate api keys without downtime

Overlap windows, dual-key auth, and when to revoke.

approved. becomes the article below

Guide · from your auth docs

Brief

Idempotency keys that survive retries

idempotency key best practices

Key scoping, storage TTLs, and safe replay semantics.

Guide · from your API reference

Brief

Rate limiting without client pain

api rate limiting strategies

Budgets, burst handling, and honest 429 responses.

Deep dive · from your gateway docs

Brief

Cursor pagination under heavy writes

cursor based pagination

rejected. this API changes next quarter

Your call, recorded

Brief

Webhook signatures that verify cleanly

verify webhook signature

Signing schemes, clock skew, rotation-safe checks.

Tutorial · from your webhooks guide

+4 more briefs in this batch, each yours to approve or reject.

Approve a brief and the run below starts.

How an article gets made.

1. Research pass

  • Keyword gaps
  • Competitor scan
  • Search intent
  • Source material

2. Thesis

  • The angle
  • Evidence plan
  • Claims to avoid

3. Outline check

  • Section goals
  • Key points
  • Evidence anchors
  • Your approval

4. Draft, marked

  • Brand voice
  • Tech review
  • Editorial review
  • SEO review
  • Citations
  • Illustrations

5. Approved

  • Final review
  • Your sign-off
  • One-click publish
  • Export formats
  • Search performance

The visuals

The article comes illustrated.

Figures are generated with the draft and reviewed beside the prose. Diagrams, charts, code, tables, math, and motion, from Mermaid to Manim, plus AI illustration.

Rotating API keys without downtime

The overlap window is the whole trick. Issue the new key, let both keys authenticate while clients migrate, and revoke the old one only after traffic has moved.

Mermaid sequence diagram of the key rotation handshake

rendered with the draft

Both keys authenticate during the overlap window.

How long to wait follows from the longest-lived token still in flight:

trevoke ≥ tissue + TTLmax + Δ

Traffic during the cutover tells you when that has happened:

Line chart of traffic cutover between key versions

Every frame was produced by Cowrite's visual engines.

  • Mermaid
    Hand drawn Mermaid flowchart routing a request by key version: v1 and v2 are accepted, anything else returns 401.
  • Graphviz
    Graphviz diagram: key v1 in its grace period and key v2 active, both routed through a gateway to the service.
  • Animated chart
  • D3
    D3 area chart of requests on the new key with an annotation marking when v1 was revoked.
  • Markmap
    Markmap mind map of a key rotation checklist, branching into overlap, cut over, and clean up.
  • Diagram video
  • Code
    Syntax highlighted JavaScript on a light github theme: a verifyKey function compares the presented x-api-key against every active key with timingSafeEqual and returns a 401 when none match.
  • Manim
  • AI illustration
    Client-server architecture illustration: web, mobile, and desktop clients send HTTPS requests through a load balancer to three application servers, which read and write a primary database.

You hold the red pen.

You set the bar once. Every article meets it, no matter who is in the queue that day.

  • Outline approved before drafting starts
  • Draft approved before export
  • Request changes with specific feedback
  • Every approval and revision recorded with actor and timestamp
  • Research depth set per project
  • SEO structure enforced automatically

After sign-off

Sign-off is not the finish line.

Approved articles publish in one click or on a schedule, to the CMS you already use. Then Search Console reports back, query by query.

Approved means published.

Publishing

Schedule active

Connected destinations

  • WordPress
  • Ghost
  • Hashnode
  • dev.to
  • GitHub repo
  • X articles
  • your webhook

  • Designing zero-downtime API key rotation

    WordPress · Jul 22

    PUBLISHED

  • Idempotency keys that survive retries

    Ghost · Tue Aug 4, 09:00

    SCHEDULED

  • Rate limiting without client pain

    GitHub repo · opens a PR

    IN REVIEW

One click now, or a date the calendar keeps. Exports still ship: Markdown, HTML, PDF, DOCX, ODT.

Every article reports back.

Performance

Tracking active

Designing zero-downtime API key rotation

Google Search Console · Last 28 days

Example report · illustrative figures

Search impressions

12.4K

+21%

Search clicks

486

+34%

CTR

3.9%

+0.6pt

Avg. position

6.2

up from 9.8

IMPRESSIONSCLICKSPUBLISHED
  • rotate api keys without downtimePosition 4212 clicks
  • api key rotation best practicesPosition 7141 clicks
  • zero downtime key rotationPosition 987 clicks

Metrics synced from the accounts you connect.

Built for technical teams and the founders who know their product.

Content and developer-marketing teams

Predictable output at scale without sacrificing technical credibility. Cowrite handles keyword research, source-checked drafts, and approval workflows, so your team focuses on decisions, not drafts.

See plans for teams →
Founders who know their product

Your product docs, your use cases, your voice. You bring the product knowledge; Cowrite handles search intent, structure, and internal links.

Start free →
Vivek Maskara, founder of Cowrite and mdedit.ai

Why I'm building Cowrite

I've shipped technical tutorials and product explainers across publications and company blogs. The hard part was rarely the first draft. It was knowing what was worth writing, keeping the draft tied to product reality, and making every claim hold up to a technical reader.

Cowrite comes from the same writing and product-building experience behind mdedit.ai, my markdown editor for technical writers. Cowrite carries that discipline earlier into the pipeline: search opportunity, source-aware drafting, and review gates before anything ships.

Cowrite is early. The roadmap says plainly what doesn't exist yet.

Read the full story →

FAQ

Questions worth answering upfront.

See what is live on the roadmap →
What does Cowrite cost?

Pro starts at $29/month ($290/year), Scale starts at $79/month ($790/year). Both plans include a 3-day free trial, card required, cancel anytime.

Is Cowrite for high-volume content production?

No. If your content strategy is volume at any quality, there are cheaper tools. Cowrite is for teams ranking on technical queries their competitors cannot answer without their documentation.

What is real today versus on the roadmap?

Research, briefs, outlines, drafting, source-checking, visual generation, and review gates are live today. So is publishing: an approved article can go straight to WordPress, Ghost, Hashnode, dev.to, X articles, a GitHub repository, or your own webhook, either right away or on a date you schedule, and it still exports as Markdown, HTML, PDF, DOCX, or ODT. Google Search Console performance tracking is live for the accounts you connect. Anything not listed here should be treated as not live yet.

How does the approval workflow work?

Projects can require approval at the outline and draft stages. Your team approves before the pipeline continues, or requests changes with specific feedback. Approvals, revisions, and generation events are recorded with actor and timestamp.

Which visual engines does Cowrite use?

Cowrite renders diagrams and charts with Mermaid, Graphviz, Markmap, Vega-Lite, Plotly, and D3, sets math with KaTeX, and styles code blocks and tables to match the article. It also produces motion where a still will not do: Manim explainer videos, animated charts, and Remotion diagram videos, plus AI-generated cover images and illustrations.

Does Cowrite check claims against my documentation?

Drafts are checked against the product or source material you provide before they are treated as publication-ready. This is a technical review pass, not a guarantee that every claim is valid, and it is not a full ingestion of a company knowledge base.

What is a Brand Voice Profile?

A learned representation of your team's writing voice, built from your existing published content. It keeps tone, vocabulary, and heading style consistent across drafts instead of reinventing your voice every article.

Is Cowrite a full workspace?

Yes. Articles live in workspaces with teams and permissions, versioning and cloud sync, commenting and suggestions, and a contextual AI chat assistant in the editor. The pipeline is the front door; the editor is where your team works.

What happens to my data?

Your projects, drafts, and connected source material stay in your workspace. Google Search Console performance tracking is connection-level and only active for accounts you connect.

Turn your product knowledge into rankings.

Source-checked against your docs. Approved by your team. Ready to rank.

Start free

From $29/month. 3-day free trial, cancel anytime.