Tenant API key. Add a key, move your clients to it, then revoke the old one:

DC="docker compose --env-file .env -f deploy/docker-compose.yml"
$DC exec ohs /ohs admin tenant list
$DC exec ohs /ohs admin key create --tenant <tenant id>
$DC exec ohs /ohs admin key list --tenant <tenant id>
$DC exec ohs /ohs admin key revoke --tenant <tenant id> --key <old prefix>

A user token minted with the old key keeps working until it expires. key revoke with a whole user token (ohs_ut_...) revokes that token.

OHS_ENCRYPTION_KEY. From the next release, rotate it online: put the new key in OHS_ENCRYPTION_KEY and the old one in OHS_PREVIOUS_ENCRYPTION_KEYS, restart every process, run ohs admin rekey, then remove the old key once ohs doctor says nothing uses it. The whole procedure, and what happens when a step is skipped, is in rotating the encryption key. On 0.1.0, and whenever the old key is not kept, replacing it leaves the stored OAuth tokens, webhook secrets and provider keys saved in the console unreadable: each user must connect the provider again. Uploads and stored data are not affected.
Provider secrets. See the Withings note under operating notes below.
POSTGRES_PASSWORD only applies when the database volume is first created. To change it later, run ALTER USER ohs PASSWORD '...' in psql, then update .env and recreate both containers.

Rotating secrets