Sign in

ROTATE the busbar key-signing key. Rotation is REVOKE-ALL by design: a new signing key means every token minted under the OLD key stops verifying, so every outstanding key must be re-minted. 1.5.0 is single-key, so this reports the intent + current kid; the actual swap is an operator action (replace auth.signing_key / the persisted key file and restart/reload every node in lockstep) (1.5.0)

Changed on
post/api/v1/admin/signing-key/rotate

Request

  • The document declares no server URL.
  • Auth: one of:
    • API key in header x-admin-token
    • HTTP bearer

Response

{current_kid, revoke_all, message}: the rotation intent + revoke-all warning

current_kidstring required

The current signing-key id (kid) that tokens are minted under.

messagestring required

Human-readable guidance for the operator-driven lockstep rotation.

revoke_allboolean required

Always true: rotating the signing key revokes every outstanding key (all must be re-minted).

Changes