Best Practices for Updating Appwrite Environment Keys Securely

[poptoall1-design]

I want to update my environment keys, especially OPENSSL_KEY, without causing downtime or breaking existing user data.
What’s the recommended workflow for safely rotating encryption keys?
Should the old key be kept temporarily during migration?
Are there any logs or checks I can monitor to ensure nothing breaks?
I would appreciate step-by-step guidance or any best practices from the community.

[dharunashokkumar]

Always take a full backup before changing keys. Generate a new key (openssl rand -base64 32) and update your .env. Keep the old key temporarily in _APP_OPENSSL_KEY_OLD until you confirm all data is accessible.