How age is tracked
Each secret has a value age, measured from the last time its value changed.
Because the server only sees ciphertext, a value counts as changed when its ciphertext changes. The TUI reuses the stored ciphertext when a value is unchanged, so editing other fields doesn’t reset the age.
The TUI bulk editor treats a renamed key as a deleted secret plus a new one, so renaming a key
inside the bulk editor resets its age.
Secrets created before rotation tracking
Secrets written before rotation tracking existed don’t have a recorded value age. Relic infers one from the secret’s last update time, ignoring updates caused by project key rotation. If a secret was renamed or moved before tracking was enabled, its age may be shorter than the real value age.Rotation policies
A policy is a whole number of days between 1 and 3650. You can set one on an environment, on a single secret, or both. A secret policy overrides its environment’s policy. Each secret gets one of these statuses:
For example, with a 90-day policy a secret is due soon from day 76 and overdue from day 90.
Set a policy
- CLI
- TUI
rotation.policy_updated.
Check rotation status
CLI
(env) means the policy comes from the environment.
TUI
Each secret shows its value age on the right of the row. Overdue secrets are marked with! in red, and secrets that are due soon with ~ in yellow. Environments with a policy show it as ↻ 90d.
Web dashboard
The Rotation card on the dashboard lists overdue and due-soon secrets across all projects you own or have been shared with, showing each secret’s project and environment.Fail CI on overdue secrets
Add--fail-on-overdue to exit with code 1 when any secret is overdue. Secrets that are due soon don’t fail the check.
In CI, relic rotation status authenticates with a service account token. The token already identifies the project, so --project isn’t needed, and OIDC policies are enforced the same way as for relic run. The check only reads names and timestamps and never downloads secret values.
RELIC_SERVICE_TOKEN, the command uses your relic login session. relic rotation set and relic rotation clear always require a session.
Weekly digest
You can opt in to a weekly email listing your overdue secrets. Turn it on from Settings > Notifications in the web dashboard.- The digest is sent on Mondays and only when at least one secret is overdue.
- It lists up to 25 secrets with their project, environment, age, and policy.
- It includes secret names but never values.