Users

users_keys_rotate

Rotate this product's JWT signing key with ZERO verifier downtime.

Tool

users_keys_rotate

Rotate this product's JWT signing key with ZERO verifier downtime.

Rotate this product's JWT signing key with ZERO verifier downtime. The standby key (generated now if there is none) becomes the signing key, and the old one is retired into an overlap window — BOTH key ids stay in the published JWKS until `overlapExpiresAt`, so every token signed before the rotation keeps verifying for the rest of its life and no verifier has to re-fetch anything to keep working. The overlap is the product's access-token TTL plus five minutes. After it elapses the old key is revoked automatically and stops verifying. Use users_keys_revoke instead if the key is COMPROMISED and must die now.

Behavior

HTTP: POST /users/keys/rotate

Arguments

No arguments.

Response

Field	Type	Always	Description
currentKid	string	•	The key signing from now on.
previousKid	string	•	The key just retired. Null if there was none.
overlapExpiresAt	string	•	When the retired key stops verifying. Both kids are in JWKS until then.

Try it

Rotate this product's JWT signing key with ZERO verifier downtime.

When to use

Example

Ask your agent something like this:

Rotate this product's JWT signing key with ZERO verifier downtime.

The agent will invoke users_keys_rotate with these arguments:

{}