roh26it · Nov 12, 2026
diff --git a/aigw/self-hosting/hybrid-deployments/gateway-registration.mdx b/aigw/self-hosting/hybrid-deployments/gateway-registration.mdx
@@ -71,6 +71,46 @@ The overview page shows:
 
 ---
 
+## Rotate the Gateway Authentication Key
+
+Each registered gateway authenticates to Prisma AIRS AI Gateway with an auth key. Set it as the `PORTKEY_CLIENT_AUTH` value in your deployment. Rotate it from the gateway's overview page, for example after a suspected exposure or on a regular schedule.
+
+<Steps>
+<Step title="Open the deployment">
+Go to **Admin Settings → Gateway Registration** and open the deployment. In the **Gateway Authentication** card, click **Rotate Key**.
+
+<Frame>
+  <img src="/images/self-hosting/gateway-auth-rotate-key.png" alt="Gateway Authentication card with a Rotate Key button" />
+</Frame>
+</Step>
+<Step title="Set a grace period">
+Enter a **Grace period (hours)**, from 0 to 24, for how long the previous key keeps working. Leave it empty to use the default. Click **Confirm Rotation**.
+
+<Frame>
+  <img src="/images/self-hosting/gateway-auth-grace-period.png" alt="Rotate key dialog with an optional Grace period in hours and a Confirm Rotation button" />
+</Frame>
+</Step>
+<Step title="Copy the new key">
+Copy the new key and store it in your secret store. It is shown only once.
+
+<Frame>
+  <img src="/images/self-hosting/gateway-auth-new-key.png" alt="New gateway authentication key shown once, with copy and Done controls" />
+</Frame>
+</Step>
+<Step title="Update every deployed gateway">
+Set `PORTKEY_CLIENT_AUTH` to the new key in each gateway deployment that uses this registration, then restart the gateways.
+</Step>
+<Step title="Verify the connection">
+Open the deployment and click **Verify Connection**. Confirm the status is **Active** and **Last Sync** updates.
+</Step>
+</Steps>
+
+<Warning>
+  Gateways still using the old key stop working once the grace period ends. With a grace period of `0`, the old key stops working immediately and gateways lose sync until you deploy the new key. Pick a grace period long enough to update and restart every gateway.
+</Warning>
+
+---
+
 ## Disable the SaaS Gateway
 
 The **SaaS Gateway** toggle at the top of the Gateway Registration page controls whether your organisation can send traffic to the Prisma AIRS AI Gateway SaaS gateway. Turn it off to route all traffic through your own registered gateways.

diff --git a/aigw/support/rotate-credentials.mdx b/aigw/support/rotate-credentials.mdx
@@ -242,7 +242,7 @@ Create the new credential at the destination, update the AI Gateway configuratio
 
 For [hybrid deployments](/aigw/self-hosting/hybrid-deployments/architecture), rotate every secret in your deployment configuration:
 
-- **`PORTKEY_CLIENT_AUTH`**: the credential your gateway uses to sync with the AI Gateway control plane. Contact Palo Alto Networks support to have it reissued, then update your deployment and restart the gateway.
+- **`PORTKEY_CLIENT_AUTH`**: the credential your gateway uses to sync with the AI Gateway control plane. Rotate it yourself: open the deployment under **Admin Settings → Gateway Registration**, click **Rotate Key**, set a grace period, and copy the new key. To cut off a possibly exposed key, use a grace period of `0` or a few hours. Then update your deployment and restart the gateway. See [Rotate the Gateway Authentication Key](/aigw/self-hosting/hybrid-deployments/gateway-registration#rotate-the-gateway-authentication-key).
 - **Log store credentials:** for example `LOG_STORE_ACCESS_KEY` and `LOG_STORE_SECRET_KEY` (S3, GCS HMAC, or Azure storage).
 - **Cache and database credentials:** Redis, and any database your deployment uses.
 - **Provider keys and other values in your environment files, Helm values, or Kubernetes secrets.**

diff --git a/images/self-hosting/gateway-auth-grace-period.png b/images/self-hosting/gateway-auth-grace-period.png
diff --git a/images/self-hosting/gateway-auth-new-key.png b/images/self-hosting/gateway-auth-new-key.png
diff --git a/images/self-hosting/gateway-auth-rotate-key.png b/images/self-hosting/gateway-auth-rotate-key.png
diff --git a/self-hosting/hybrid-deployments/gateway-registration.mdx b/self-hosting/hybrid-deployments/gateway-registration.mdx
@@ -80,6 +80,46 @@ The overview page shows:
 
 ---
 
+## Rotate the Gateway Authentication Key
+
+Each registered gateway authenticates to Portkey with an auth key. Set it as the `PORTKEY_CLIENT_AUTH` value in your deployment. Rotate it from the gateway's overview page, for example after a suspected exposure or on a regular schedule.
+
+<Steps>
+<Step title="Open the deployment">
+Go to **Admin Settings → Gateway Registration** and open the deployment. In the **Gateway Authentication** card, click **Rotate Key**.
+
+<Frame>
+  <img src="/images/self-hosting/gateway-auth-rotate-key.png" alt="Gateway Authentication card with a Rotate Key button" />
+</Frame>
+</Step>
+<Step title="Set a grace period">
+Enter a **Grace period (hours)**, from 0 to 24, for how long the previous key keeps working. Leave it empty to use the default. Click **Confirm Rotation**.
+
+<Frame>
+  <img src="/images/self-hosting/gateway-auth-grace-period.png" alt="Rotate key dialog with an optional Grace period in hours and a Confirm Rotation button" />
+</Frame>
+</Step>
+<Step title="Copy the new key">
+Copy the new key and store it in your secret store. It is shown only once.
+
+<Frame>
+  <img src="/images/self-hosting/gateway-auth-new-key.png" alt="New gateway authentication key shown once, with copy and Done controls" />
+</Frame>
+</Step>
+<Step title="Update every deployed gateway">
+Set `PORTKEY_CLIENT_AUTH` to the new key in each gateway deployment that uses this registration, then restart the gateways.
+</Step>
+<Step title="Verify the connection">
+Open the deployment and click **Verify Connection**. Confirm the status is **Active** and **Last Sync** updates.
+</Step>
+</Steps>
+
+<Warning>
+  Gateways still using the old key stop working once the grace period ends. With a grace period of `0`, the old key stops working immediately and gateways lose sync until you deploy the new key. Pick a grace period long enough to update and restart every gateway.
+</Warning>
+
+---
+
 ## Disable the SaaS Gateway
 
 The **SaaS Gateway** toggle at the top of the Gateway Registration page controls whether your organisation can send traffic to the Portkey SaaS gateway. Turn it off to route all traffic through your own registered gateways.

diff --git a/support/rotate-credentials.mdx b/support/rotate-credentials.mdx
@@ -229,7 +229,7 @@ Create the new credential at the destination, update the Portkey configuration,
 
 For [hybrid deployments](/self-hosting/hybrid-deployments/architecture), rotate every secret in your deployment configuration:
 
-- **`PORTKEY_CLIENT_AUTH`**: the credential your gateway uses to sync with the Portkey control plane. Contact [Portkey support](/support/contact-us) to have it reissued, then update your deployment and restart the gateway.
+- **`PORTKEY_CLIENT_AUTH`**: the credential your gateway uses to sync with the Portkey control plane. Rotate it yourself: open the deployment under **Admin Settings → Gateway Registration**, click **Rotate Key**, set a grace period, and copy the new key. To cut off a possibly exposed key, use a grace period of `0` or a few hours. Then update your deployment and restart the gateway. See [Rotate the Gateway Authentication Key](/self-hosting/hybrid-deployments/gateway-registration#rotate-the-gateway-authentication-key).
 - **Log store credentials:** for example `LOG_STORE_ACCESS_KEY` and `LOG_STORE_SECRET_KEY` (S3, GCS HMAC, or Azure storage).
 - **Cache and database credentials:** Redis, and any database your deployment uses.
 - **Provider keys and other values in your environment files, Helm values, or Kubernetes secrets.**