# What Happens When You Hardcode an API Key

> Stealing it costs hours. Rotating it can cost days.

- **Format:** short video, 8 steps, ~26 seconds
- **Topic:** What actually happens after a hard-coded Azure key leaks — the bill climbs, and then rotating the key kills every installed copy of your own app, because a secret shipped inside a mobile app cannot be replaced without an app store release.
- **Author:** Suthahar Jegatheesan (MSDEVBUILD)
- **Category:** Azure · Azure Security
- **Published:** 2026-08-18
- **Tags:** azure, security, azurekeyvault, devsecops, apisecurity, mobilesecurity, cloudsecurity, dotnet, finops, managedidentity, backenddeveloper, softwareengineering, microsoftazure, msdevbuild
- **Canonical URL:** https://blog.msdevbuild.com/shorts/hardcoded-key-blast-radius/

---
## What you'll learn

- Why a leaked key costs money long before anyone notices it leaked
- Why rotating a hard-coded key kills every installed copy of your app
- Why a secret in Azure Key Vault rotates with nobody updating anything

## Understand it one step at a time

### 1. One line, shipped

A key hard-coded in the app, shipped on forty thousand phones — everyone says don’t do this, and here it is anyway.

### 2. A stranger has the key

He unzipped the package and found it in strings.xml — same file, same minute of work as always.

### 3. The bill starts moving

Deletion gets noticed. Consumption doesn’t — a stolen key against a billed API shows up as an invoice, not an alert.

### 4. So you rotate the key

Check Azure Monitor logs grouped by caller IP first, then swap to the secondary key while you regenerate the primary.

### 5. And you killed your own app

The key you just revoked was in every installed copy — you didn’t fix the incident, you caused an outage on top of it.

### 6. The repair takes days

A new build, a store review, then waiting on forty thousand people to update — days, while the outage is already live.

### 7. None of it had to happen

Key Vault plus a ReloadInterval means the app never held the key at all — rotating it changes nothing for a single user.

### 8. A secret you cannot rotate

If undoing a leak needs an app store release, the key was never really rotatable — and that was true before it ever leaked.

---

## The takeaway

**A secret you cannot rotate is not a secret.**

A key in the app store takes days to replace. A key in Azure Key Vault takes one click.