Rotate an API key with overlap window #11

New issue

Open

opened 2026-07-01 01:01:04 +00:00 by manlycucumber · 0 comments

manlycucumber commented

2026-07-01 01:01:04 +00:00

(Migrated from github.com)

Problem

Tenants must rotate keys without downtime. Rotation should issue a new secret while the old one keeps working for a bounded overlap.

Acceptance criteria

Rotating a key issues a new secret and reveals it once, while the prior key stays valid until a configurable grace deadline
After the grace deadline the prior key is automatically rejected
The new and old keys are linked so the rotation history is visible
Rotation events are written to the audit log

## Problem Tenants must rotate keys without downtime. Rotation should issue a new secret while the old one keeps working for a bounded overlap. ## Acceptance criteria - [ ] Rotating a key issues a new secret and reveals it once, while the prior key stays valid until a configurable grace deadline - [ ] After the grace deadline the prior key is automatically rejected - [ ] The new and old keys are linked so the rotation history is visible - [ ] Rotation events are written to the audit log

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Directorium/Site#11

No description provided.

Rows
Columns