What is the safest way to rotate API keys for a production AI bot?

Use overlapping keys. Create a new active key, send it to the bot owner, allow both old and new keys during a short migration window, then revoke the old key after the bot confirms successful authentication.

Create a bot_api_keys table with fields for bot ID, key hash, key prefix, status, created date, expires date, and revoked date. This lets you support rotation, auditing, and rollback.