Error

A valid request URL is required to generate request examples

{
  "environment_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "kid": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "grace_hours": 123
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

Environments

Rotate the signing key

Requires api_keys:write — the same gate as the identity secret, because this key mints the tokens a developer’s backend trusts.

The old key stops signing immediately and keeps verifying for a 24-hour grace window: the overlap that lets JWKS caches refresh and in-flight JWTs expire. For a suspected compromise the same arithmetic runs in reverse — every token signed with the old key is dead within its 5-minute lifetime of the rotation, which is the bound to quote.

POST

organization

environments

{id}

signing-key

rotate

Error

A valid request URL is required to generate request examples

{
  "environment_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "kid": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "grace_hours": 123
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

Autorizações

Authorization

string

header

obrigatório

A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange.

Cabeçalhos

X-Organization-Id

string

The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing. Absent, the session's default organization answers.

Parâmetros de caminho

string<uuid>

obrigatório

The environment's id.

Resposta

Rotated.

environment_id

string<uuid>

kid

string<uuid>

The new key's id, which is also its kid in JWKS.

grace_hours

integer

How long the previous key keeps verifying.

Rotate the identity secret List social providers

⌘I

Visão geral

Endpoints

Rotate the signing key

Autorizações

Cabeçalhos

Parâmetros de caminho

Resposta