Home / API key expiration reminders for founders
Feature
API key expiration reminders, before the deploy fails
StackHangar tracks when your API keys, domains and certificates expire, across every product you run, and emails you 30, 7 and 1 days before and on the day. Each one links to the steps to fix it.
Why expiry sneaks up on you
Most outages from an expired credential are boring. Nothing was attacked, nothing was misconfigured. Someone set a date once and nobody saw it coming.
- Tokens with a fixed lifetime. Many personal access tokens and service keys expire in 30 to 90 days. The first sign is a failing deploy or a
401from your own app. - Domains on auto-renew with a dead card. Auto-renew only works until the card on file stops working, and the warning email goes to whoever registered the domain years ago.
- Reminders sent to the wrong inbox. Providers often email only the person who created the key. If that was an old address, a former teammate or an AI agent, nobody reads it.
- Keys that never expire. Many API keys have no end date at all. They stay valid until someone rotates them, which means they stay valid forever unless you set a reminder yourself.
With one product you can keep this in your head. With four, the dates live in four dashboards and a few old emails. A single list sorted by date is what's missing.
What StackHangar tracks
Everything in your vault is an item, and an item can carry an expiry or renewal date. The item types are API keys, logins, domains, certificates, memberships, subscriptions, databases and notes. Items are grouped by project and environment, so you can see that the key about to expire is the production one.
- API keys, certificates, memberships and database credentials with an expiry date, or a rotation interval ("rotate every 90 days") counted from the last time you rotated.
- Domains with a renewal date and whether auto-renew is on.
- Subscriptions in a renewal calendar. They charge automatically, so they appear there but don't send email reminders.
Keys that don't expire still get flagged
A key with no end date is the quiet risk. For API keys and database credentials, StackHangar flags any that have no expiry and no rotation reminder as no reminder set, so you can pick a rotation interval. If you know a key really never expires, you can mark it that way and the flag goes away.
One more thing shows up on Home for keys, without sending email:
- Provider changes. If a provider is retiring a key format, the item is flagged. Today this covers Supabase's legacy
anonandservice_rolekeys.
How the reminders work
Each item with a date gets email reminders on a fixed schedule:
- 30 days before it's due
- 7 days before
- 1 day before
- On the day
That schedule is the same for everyone, and email is the only channel today. You can't change the lead times or add another channel yet. Reminders go to your sign-in email, shown in Settings. A reminder date that's already passed when you save an item is skipped, so a key that expires in 10 days gets the 7-day, 1-day and day-of emails.
You get at most one email a day, however many items are due. Domains with auto-renew on still get reminders, because auto-renew failing looks like auto-renew working until the day it doesn't. Subscriptions don't, as noted above.
What the email says
The email gives a number and a link to open the app. It looks like "3 items in your hangar need attention". It doesn't include project names, item names or the keys themselves, and we can't read them anyway.
That's deliberate. StackHangar is zero-knowledge: your vault is encrypted on your device, and our servers hold only ciphertext, opaque item IDs and the dates they need to send the reminder. Your browser works out the send dates and schedules them. The email can tell you something needs attention, and the app tells you what.
The honest limit. Because the email can't name the item, you open the app to see which one it is. We chose a vague email over a server that knows what you store.
Ranked by what breaks first
Home lists what needs attention across all your projects, in a fixed order. The same rules produce the same list every time, and no AI decides the order.
- Expired. Already past its date.
- Next 7 days.
- Next 30 days.
- Provider changes. For example, a key format being retired.
- Hygiene. Keys with no reminder set.
Inside each group, things that stop working at their date come before rotation reminders for keys that still work. Production and things that take a product down, like a domain, a certificate or a membership, come before the rest. After that, the soonest date wins. So an expired production domain is above a staging key due next week.
From alert to fix
An alert you can't act on is just stress. On Home, each item has a Fix button that starts its rotate or renew playbook, and you can snooze it. The playbook already knows which account owns the item and where it's deployed, so the steps are filled in for that key. When you're done, mark it rotated or renewed and the reminders reset to the new date.
The steps follow the same order as our guide to rotating an API key without downtime: create the new key, update every place it's used, redeploy, verify, then revoke the old one. If you think a key leaked, the leaked key playbook is the faster, messier version.
Which providers show a key's expiry through their API
If you track expiry by hand, it helps to know where a provider can tell you. Of the providers in our catalog, these are the ones whose docs say a key's expiry date can be read through their API. The rest either don't expose it or we couldn't confirm it, so for those you enter the date yourself.
| Provider | Credential | What the API shows |
|---|---|---|
| Anthropic | API key | expires_at from the Admin API list and get endpoints; null if no expiry. |
| GitHub | Fine-grained personal access token | Organization owners can read token_expires_at and token_expired from the organization token endpoints. |
| Google Cloud | Service account key | The key resource carries validBeforeTime. Keys don't expire by default. |
| Neon | Neon Auth API key (beta SDK) | An optional expiresAt field and an isValid() check in the SDK. |
| OpenAI | Project API key | expires_at from the project keys list; listing needs an admin key. |
| OpenAI | Admin API key | expires_at in create and list responses. |
| OpenRouter | API key | expires_at in list responses; needs a management key. |
| Vercel | Access token | expiresAt appears in the list tokens example response; it isn't documented as a required field. |
Two things to take from the table. Even where the date is in the API, reading it often takes an admin or owner credential, so it's rarely something a small team already automates. And the most-used keys, such as Stripe's, aren't on the list: we couldn't confirm an expiry field for them. For those, a rotation reminder is how you track them.
Common questions
Can I change when reminders arrive?
Not today. Reminders go out 30, 7 and 1 days before and on the day, by email.
Do subscriptions send reminders?
No. They charge automatically, so they appear in the renewal calendar instead.
Do I need to enter every date by hand?
Yes, today you set the date or a rotation interval on each item. Reading expiry from your providers automatically isn't something StackHangar does yet.
Does it work for domains too?
Yes. Add the domain with its renewal date and whether auto-renew is on, and you get the same reminders.
Get warned before the next one
Put your first two projects in StackHangar for free and add the dates that matter.