---
key: rotate-or-revoke-a-source-address
title: Rotate or revoke a source address
audience: staff
section: critical-alerts
routes: ["/critical-alerts/sources"]
permissions: ["critical_alerts.sources.manage"]
features: ["critical_alerts.core"]
since: 0.0.1
updated: 0.0.1
status: published
summary: Issue a new signal address for a source, keep the old one alive for a grace period while you switch the outside system over, then revoke it.
keywords: [rotate token, new webhook url, lost address, revoke, secret leaked, change url, grace period, old address]
related: [critical-alerts-04-sources-and-incoming-webhooks, critical-alerts-guide]
---

In the sidebar, open **Critical Alerts**, then **Setup**, then **Sources**. The page address is `/critical-alerts/sources`. On the source's row, press **Tools** to open **Source endpoint & tools**.

Rotate when you lost the address, when someone who had it leaves, or when you suspect it leaked. Nova issues a new address and keeps the old one working for a grace period, so the outside system keeps reaching you while you switch it over.

## Before you start

- Your admin has to give your role permission to manage critical alert sources.
- Be ready to update the outside system right away.

## Steps

1. Press **Tools** on the source. The **Source endpoint & tools** drawer opens.
2. Under **Rotate token**, set **Grace period hours**. This is how long the old address keeps working. It must be at least 1.
3. Press **Rotate token**. The new address appears under **POST endpoint**, marked as rotated and shown once.
4. Press **Copy new POST endpoint** and paste the address into the outside system. Press **I have stored it** when you are done.
5. Send a real or test signal on the new address and confirm it arrives under **Signals**.
6. Under **Token lifecycle**, find the old token and press **Revoke**. Confirm with **Revoke token**.

> **Warning:** Revoking is immediate. Anything still sending to the old address stops reaching Nova the moment you confirm. Revoke only after you have seen traffic on the new address.

## What you see

- **Token lifecycle** lists every address ever issued, with its status, a **Primary** tag on the one in use, the last few characters of the token, when it was created and when it was last used.
- **Revoke** is greyed out on the last active token, with a note that at least one active address has to stay available.
- A token inside its grace period reads "Valid until" followed by the date the grace period ends.

## If something looks different

- "Grace period must be at least 1 hour.": type a whole number of 1 or more.
- You cannot see the full address any more: it is shown only right after creation or rotation. Rotate again to get a new one.
- The **Sources** page is missing from the sidebar: your role cannot manage sources.

[[route:/critical-alerts/sources|Open Sources]]