Post-mortem sanity check: how do you handle “un-scannable” expiries (API keys, internal certs) without spreadsheets?

We just had a ~2 hour outage because a 3rd-party API key expired.

What’s annoying is that this wasn’t a surprise. We knew about it. It was written down in a “DevOps Secrets” spreadsheet, and someone even had a calendar reminder, but that person was on PTO, and honestly the spreadsheet hadn’t been opened in months.

We already use UptimeRobot for public SSL certs, so those are fine. But for the “offline” stuff , Apple Push certs, API tokens, internal signing keys, we don’t seem to have a good answer.

I’m honestly just trying to sanity-check how other teams deal with this:

Do you actually have a tool that tracks these properly? Or is everyone using some shared spreadsheet + reminders and hoping it doesn’t get missed?

I’m tempted to hack together a cron job to nag us, but that feels like yet another fragile workaround that’ll probably rot over time. Curious what’s actually worked for people.