# Rotation of GitHub Deploy Keys

**URL:** <https://discuss.circleci.com/t/rotation-of-github-deploy-keys/32232>\
**Category:** Build Environment\
**Created:** [September 3, 2019, 11:08am UTC](https://discuss.circleci.com/t/rotation-of-github-deploy-keys/32232 "2019-09-03T11:08:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mfmcdonagh](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/mfmcdonagh/32/23113_2.png) [@mfmcdonagh](https://discuss.circleci.com/u/mfmcdonagh)\
**Post date:** [September 3, 2019, 11:08am UTC](https://discuss.circleci.com/t/rotation-of-github-deploy-keys/32232/1 "2019-09-03T11:08:41Z")

</div>

When a Github repo is added to CircleCI its my understanding that CircleCI adds a deploy key to GitHub. This key gives read only access to the repo.

If a user decides to run a job via “Rerun job with SSH”, they can access that key as its accessible to them in the .ssh folder.

I’m concerned that when a user leaves the org that they can take with them a copy of the deploy key and retain read access to the repo.

Is there any mechanism to rotate the deploy keys when someone leaves my org ?

---

<div class="post-metadata">

**Author:** ![lynncyrin](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/lynncyrin/32/21991_2.png) [@lynncyrin](https://discuss.circleci.com/u/lynncyrin)\
**Post date:** [December 10, 2019, 12:17am UTC](https://discuss.circleci.com/t/rotation-of-github-deploy-keys/32232/2 "2019-12-10T00:17:09Z")

</div>

I’m also interested in rotating deploy keys! It looks like you can setup a script to rotate them via these APIs? [https://circleci.com/docs/api/#keys](https://circleci.com/docs/api/#keys)