Rotating credentials before they expire
Replace a secret or certificate in place, with warning ahead of the date.
Last updated September 22, 2026
Client secrets and signing certificates expire. Replacing one used to mean deleting the connection and recreating it, which trips the lockout protection and is the most likely way a routine renewal becomes an incident.
Replacing in place
An administrator can replace a credential directly on the connection. The connection stays enabled throughout, so the sign-in policy is never at risk during a rotation.
Recording the lifetime
When you create or rotate a credential you record how long it lasts: a fixed period, a specific date, or never expires. Where you supply a certificate, the expiry is read from the certificate itself rather than typed in, because a typed date and a real one drift apart.
How you are warned
The connection shows an advisory well ahead of the date and escalates in the final week. Pytheus will never disable a connection on its own because a recorded date passed. A date in a field is not authoritative enough to justify cutting off everyone's access, and a wrong date should not become an outage.
Next: Multi-factor authentication.