Key rotation

Key type Command When to rotate
Bootstrap admin API key sudo /opt/bng-deploy/bin/rotate-controller-key.sh Immediately after first-run wizard
Metrics scrape token sudo /opt/bng-deploy/bin/qt-scrape-token-rotate Quarterly, or after staff turnover
Per-operator API key Delete + re-mint from API Keys page Staff turnover; suspected leak
User password sudo /opt/bng-deploy/bin/reset-user-password.sh <username> User forgot / suspected compromise

Full recovery from complete key loss is documented in bootstrap-recovery.md.