Replace a leaked Floodgate key across the trusted proxy path

Floodgate's key is an authentication credential. If it appears in a public download, screenshot or repository, removing the public file alone does not make the old key trustworthy. Plan a coordinated replacement for every component that must share it.
Record the starting point
Identify the proxy, Geyser deployment and backend Floodgate installations that belong to this network. Confirm which components need the key under the official setup for their platforms. Keep the existing configuration and a complete recovery checkpoint in restricted storage.
Work through the change
Close the relevant maintenance window to player logins and stop the affected components through their normal controls. Avoid a rolling half-update that leaves some servers trusting the old key.
Follow the current Floodgate release instructions to produce the replacement key and distribute it only to the required trusted components. Use private file transfer, never a public paste or repository.
Check the documented forwarding settings on the proxy and backend. The key does not replace Velocity or Bungee forwarding configuration, and backend admission still needs the protected proxy path.
Start the network in its planned order, then test a Bedrock login and a Java login. Confirm that a normal player retains their identity and can transfer to each intended backend.
Check the result
The new shared credential should work on the trusted path, while the exposed credential no longer remains in active configuration. Check every backend, not just the first lobby. Record the rotation date without recording the secret in a public change log.
If the result differs
A failure on only one backend often means that component retained the old key, used the wrong folder or did not restart. Inspect redacted errors and configured file locations. Do not solve the mismatch by enabling unauthenticated direct backend access.
If a coordinated restart fails, keep admission closed while correcting the new deployment. Reusing the exposed key is not a sound long-term rollback. Preserve player data; a credential rotation does not require deleting accounts, worlds or inventories.
Use the file manager for the specific configuration file described in this guide; the screenshot shows the panel, not a plugin interface.
References and related help
Floodgate maintainer reference 1
Set up Geyser and Floodgate for Java and Bedrock crossplay
Set up a Velocity network with protected backend servers