osFoundry / Platform
Secret rotation
Schedule automatic rotation for every secret. Manual override per key.
What it is
Secret rotation in osFoundry lets you put every stored secret — your provider API keys, tokens, and other credentials — on an automatic rotation schedule instead of leaving them in place indefinitely. Because osFoundry is bring-your-own-key, these are your credentials for the models and services you connect (local, cloud, or self-hosted), and rotating them regularly is one of the simplest ways to shrink the window in which a leaked or stale key is useful to anyone else.
Inside osFoundry, you set a rotation schedule that applies across your secrets, and each key can be overridden manually when a service needs different treatment. That combination matters in practice: a blanket schedule keeps you covered by default, while the per-key manual override handles the one credential you need to rotate right now — after a suspected exposure, a team change, or a provider requirement — without waiting for the next scheduled cycle or forcing every other key to move with it. Rotation lives in the same Settings and Security area where your keys are managed, so the schedule sits next to the secrets it governs.
This fits the way osFoundry handles credentials generally: it is a desktop, local-first workspace, so your keys and rotation settings can stay on your device rather than passing through a reseller. There is no per-seat fee gating security features, and because osFoundry never marks up the keys you bring, rotation is about hygiene and control over your own credentials — not a billing lever. The goal is that keeping secrets fresh is the default state of the workspace, not a chore you remember to do by hand.
Key capabilities
- Schedule automatic rotation that applies to every secret you store, so keys don't sit unchanged indefinitely
- Override any single key manually to rotate it immediately, independent of the shared schedule
- Covers the BYOK credentials you connect — provider API keys and tokens for local, cloud, and self-hosted models
- Rotation lives in Settings and Security, alongside the keys it governs
- Local-first by design: keys and rotation settings can stay on your device rather than routing through a reseller
Use cases
- Solo developer: puts every provider key on a recurring rotation schedule so stale credentials expire on their own
- Security-conscious team lead: manually rotates one exposed key the moment a leak is suspected, without disturbing the rest
- Privacy-focused user: keeps BYOK secrets and their rotation policy local on the desktop instead of in a third-party vault
Frequently asked questions
What does secret rotation actually rotate in osFoundry?
The secrets you store in the workspace — your bring-your-own-key credentials such as provider API keys and tokens for the models and services you connect. You schedule automatic rotation across them, and can override any individual key manually.
Can I rotate one key without changing the schedule for everything else?
Yes. Alongside the shared automatic schedule, each key supports a manual override, so you can rotate a single credential immediately — for example after a suspected exposure — while the rest continue on their normal cycle.
Where does rotation happen, and does it stay on my device?
Rotation is part of osFoundry's Settings and Security area, next to where your keys are managed. osFoundry is a local-first desktop workspace, so your keys and rotation settings can remain on your device rather than passing through a reseller.