> ## Documentation Index > Fetch the complete documentation index at: https://docs.allgoodhq.com/llms.txt > Use this file to discover all available pages before exploring further. # Rotate or revoke your tracking key > What rotating and revoking your web tracking key actually do, and what each one breaks. Your tracking key lives on **Settings → Web Tracking**, alongside **Rotate** and **Revoke**. ## First: the key isn't a secret It sits in the `data-ag-key` attribute of every page carrying your tag, so anyone viewing your page source can read it. It says which allGood account is sending; it doesn't authorise the sender. What actually controls who can send into your account is the [allowed origins list](/mk/developer/web-edge/allowed-origins), plus [bot protection](/mk/developer/web-edge/bot-protection) for anything that isn't a browser. Somebody holding your key can only post from a website you've already allowed, and can only make traffic look like yours. That's worth knowing before you treat a leaked key as an emergency. Rotate anyway if you'd rather — but rotating has a cost, below. ## Rotate **Rotate** issues a new key and stores it. The old key keeps working until the new one has reached allGood's edge, so a rotation never leaves a window where neither key is valid and traffic goes missing. Rotating changes the value in your tag. Every page carrying the old key, and every Google Tag Manager container, has to be updated with the new one — otherwise those pages stop being recorded once the old key stops working. Do it in this order: On **Settings → Web Tracking**, click **Rotate**. The new key appears immediately. Copy the new tag and replace it everywhere — your site's ``, and any GTM container using the [generated template](/mk/developer/web-edge/install-with-gtm). Load a page and check the browser's network tab for a successful tracking request. See [Troubleshooting](/mk/developer/web-edge/troubleshooting) if it's refused. ## Revoke **Revoke** clears the key. Every tracked event is then refused until you issue a new one, and the screen shows a **revoked** badge. Use it when you want tracking to stop now, rather than when you want a different key. Revoking does **not** stop form capture. Forms are identified by their own public id and gated by the allowed origins list; they don't use the tracking key at all. To stop a form accepting submissions, unregister the form. ## The keyId Next to the key, allGood shows a short `keyId` — a fingerprint of the key in force. Quote that to support when you need to say *which* key is live, rather than pasting the key itself. ## Related Issuing a key and installing the tag for the first time. What a refused tracking request looks like, and why.