Users

users_keys_revoke

THE KEY-COMPROMISE DRILL.

Tool

users_keys_revoke

THE KEY-COMPROMISE DRILL.

THE KEY-COMPROMISE DRILL. Evict a signing key from the published JWKS IMMEDIATELY — no overlap, no grace — so every token it ever signed stops verifying at once, mint or promote a fresh signing key in its place, and (by default) sign every end user of this product out, because a token the attacker forged with the stolen key is indistinguishable from a real one. Pass `revokeSessions: false` only when you are certain no forged token was issued. Give a reason: it is the only account of the incident the audit log will keep. This is disruptive and irreversible — for routine rotation use users_keys_rotate.

Behavior

HTTP: POST /users/keys/revoke

Arguments

Name	Type	Required	Description
kid	string	•	The key to evict, as listed by users_keys_list.
reason	string	—	Why. Goes into the audit row and is the only account of the incident it keeps.
revokeSessions	boolean	—	Sign every end user of this product out as well. Defaults to TRUE: a compromised signing key could have minted any of those sessions. Pass false ONLY when you know no forged token was ever issued.

Response

Field	Type	Always	Description
currentKid	string	•	The fresh key minted or promoted in its place.
revokedKid	string	•
sessionsRevoked	integer	•

Try it

THE KEY-COMPROMISE DRILL.

When to use

Example

Ask your agent something like this:

THE KEY-COMPROMISE DRILL.

The agent will invoke users_keys_revoke with these arguments:

{
  "kid": "<kid>"
}