Record the provider account, all Domain Nexus server connections using it, scheduled jobs and other known applications. Note whether the provider allows overlapping credentials or regenerates a single existing key. A regeneration that immediately invalidates the old key needs a coordinated maintenance window.

1. Create the replacement through the provider's authenticated administration workflow with the intended scope, source-address restrictions and expiration.
2. Store the new secret in your approved credential store. Preserve the account ID, project ID, region and other non-secret mapping that should stay attached to it.
3. Edit each affected Domain Nexus server connection and replace the appropriate secret fields. Paired credentials must be updated as a coherent pair.
4. Preserve a stable Shared provider account identifier when the quota pool is unchanged.
5. Run a connection check, read an owned zone and perform one controlled temporary TXT change. Confirm background execution as well as browser-triggered access.
6. After every dependent integration has been verified, revoke the old credential at the provider. Record the completed rotation and next review date.

Prepare the complete dependency list before regenerating it. Apply the new key to each consumer promptly and expect management requests using the old value to fail until updated. Existing authoritative records are not normally removed merely because the management credential changes, but pending writes need their final outcomes reviewed.

Check its resource scope and account identity. Do not respond by linking missing zones to another customer or replacing a restricted key with an unrestricted one without reviewing the intended access. Restore the correct scope or account mapping.

If a secret was exposed, revoke it under your incident procedure and examine provider and module change history. A normal scheduled rotation and an incident response have different urgency, but both need an accurate inventory of affected integrations.

• Coordinate provider API quotas across web requests and background workers
• Run a controlled DNS provider acceptance check before assigning customer packages
• Resolve DNS drift and changes with an unknown provider outcome
• Rotate Domain Nexus API credentials across web and scheduled integrations