Rotation is usually written down as a quarterly task and is actually a question about whether two credentials can be valid at once.
if only one can be valid:
every consumer must switch in the same instant.
which means a coordinated restart. which means downtime.
which means it never happens.
if two can be valid:
1. create the new one
2. roll it out, service by service, at leisure
3. verify nothing is still using the old one
4. revoke
design for two. everything else follows.Step 3 is the one that needs building in advance: without a way to see which credential a request used, revocation is a guess followed by an incident. A per-credential identifier in the access log is usually enough. Databases make this awkward because a user is a credential, so the answer there is two users rather than two passwords — which is a schema-level decision made long before anybody thinks about rotation.