key-rotation-planner 0.1.0

Local CLI and desktop planner for prioritizing API key and secret rotations

key-rotation-planner

key-rotation-planner turns messy API key and secret inventory notes into a local rotation plan. It reads .env-style comments, CSV, or JSON records, redacts long values, scores stale keys, and produces Markdown, JSON, or HTML reports.

It is designed for teams that track provider keys, webhooks, deploy tokens, and shared credentials across notes or issue comments and need a quick rotation checklist before integrations age out.

Install

pip install key-rotation-planner

Usage

key-rotation-planner examples/secrets-inventory.txt
key-rotation-planner examples/secrets-inventory.txt --format html --output rotation-plan.html
key-rotation-planner examples/secrets-inventory.txt --fail-on-overdue
key-rotation-planner-gui

Inventory lines can be informal:

OPENAI_API_KEY=sk-redacted # service=openai env=prod owner=ai-platform last_rotated=2026-02-12 cadence=60d
STRIPE_WEBHOOK_SECRET=whsec-redacted # service=stripe env=prod owner=billing last_rotated=2026-05-18 cadence=45d
LEGACY_ADMIN_TOKEN=redacted # env=prod last_rotated=2025-12-01

CSV and JSON inputs are also supported with fields such as name, service, owner, environment, last_rotated, and cadence_days.

Output

The planner reports:

• Overdue, due-soon, healthy, and unknown-age keys.
• Due dates calculated from last_rotated plus cadence.
• Owner and production-scope gaps.
• Risk scores weighted by age, missing owner, production usage, and sensitive service names.
• Copy-ready next steps for the highest-priority rotations.

Development

python3 -m unittest discover -s tests
python3 -m build --no-isolation
python3 -m twine check dist/*

License

MIT