Why we have two accounts key for Windows Azure Services?

In today post I want to talk a little bit about the account keys from Windows Azure. There are a lot of services from Windows Azure that can be consumed using an account name and key. The account name is only one and in some situations is represented by the service namespace. In all cases the account key is duplicated. There are two account keys that can be used in parallel. Both of them can be used in the same time without problems.
But why we have two accounts key?
Well, we have two accounts key with a very good purpose. Let’s imagine the case when one of the accounts key is compromised. In this case you need to generate another key and distributed it to the clients. From the moment when you generate the new key, until you distributed it to all the clients, the specific service will not be able to be used – if you use only one key.
In the situations, when a key is not valid anymore, clients could fall back to the second key and start to use it. This mean that all the clients should access to the both accounts key.
The same scenario can be used when you need to regenerate the accounts key at a specific time interval (every 3 months). In this cases you can define a process to regenerate the accounts key without affecting the clients.