Confused about DocumentDB Access Keys

Question

In the Azure Portal under DocumentDB, I see two access keys i.e. primary and secondary.

Which one should I use calling DocumentDB from my app or should I create a new user account?

Answer 1

You can use either key to call DocumentDB from your app.

The users feature is generally used for granting permissions to specific resources (collections, documents, etc) - which may be useful in multi-tenant scenarios.

So why does DocumentDB have two access keys? It’s for rolling key changes. If you want to change the key (which is probably a good idea to do every once in a while in case it gets leaked somehow), you would have some downtime if there was only one key available (the time it takes between changing the key and updating your application configuration to reflect that). With two keys, you can first update your configuration file to use the secondary key, then regenerate the primary key and update your application’s configuration to use that – with no downtime!