Skip to main content

Rotate the signing key

POST 
/admin/signing-keys/rotate

Appoints a new key and leaves the previous one verifying until it retires. The id in each token's header is what lets one verifier hold both.

The window is the whole point. A viewer token is already in a connected browser, so retiring the old key immediately would drop the entire audience of every running battle. A window shorter than a token's own lifetime is refused rather than accepted as a careful-looking number.

A POST rather than a PUT because it is not idempotent — calling it twice mints two keys and retires two. Exactly one key ends up active, enforced by a partial unique index rather than by service logic two concurrent rotations could race.

The response carries no private key: unlike an API key there is nothing for the operator to copy, and a key that left the process would be one that could be replayed.

Super-user only.

Request​

Responses​

Rotated — the new key is signing, and who did it is recorded