ICYMI - you can manage your vercel env keys by API. If it's helpful for others, I built a little script / CLI that pulls your Vercel env vars that are not marked as sensitive into a local manifest where you can expire + replace tokens, and then republish them as sensitive vars.