Key Rotation
Key rotation is the process of replacing JWT signing keys with new material on a schedule or after suspected compromise. Effective rotation uses kid headers so verifiers accept tokens signed with both old and new keys during a overlap window. After outstanding tokens expire, retire the old key. Rotation limits blast radius of leaked secrets. Implementations across Node.js, Python, Go, Ruby, and Java follow the same RFC standards, so concepts transfer directly between stacks. Security reviews should treat this as part of your full authentication threat model, not an isolated configuration detail. Document expected behavior for client teams so tokens are issued, stored, and validated consistently across services.
Why It Matters
Rotate keys proactively — waiting for a breach forces emergency downtime. Document runbooks, automate secret generation, and test verifier behavior with multiple active kids. Pair rotation with monitoring for verification failures. Getting this wrong often surfaces only after an incident, when forged or replayed tokens expose gaps in validation or secret handling. Platform teams should encode these rules in libraries, linting, and deployment checklists so individual services cannot drift silently. Pair technical controls with monitoring: log verification failures, track unusual token lifetimes, and alert on spikes in 401 responses. Review this during every auth-related change, including framework upgrades, CDN additions, and new mobile or third-party clients.
Related Terms
Related Tools
Related Articles
Frequently Asked Questions
How often should I rotate JWT secrets?
Every 90 days for policy compliance, or immediately after any suspected leak. Consult your JWT library documentation for exact option names, defaults, and error types. When in doubt, prefer stricter validation and shorter token lifetimes over permissive shortcuts. Test edge cases with expired, malformed, and wrong-algorithm tokens in CI before shipping auth changes.
Does rotation log everyone out?
Only without kid overlap and refresh handling. Plan zero-downtime rotation to avoid mass logout. Consult your JWT library documentation for exact option names, defaults, and error types. When in doubt, prefer stricter validation and shorter token lifetimes over permissive shortcuts.
Symmetric vs asymmetric rotation?
Both support kid. Asymmetric rotation publishes new public keys to JWKS without sharing private material. Consult your JWT library documentation for exact option names, defaults, and error types. When in doubt, prefer stricter validation and shorter token lifetimes over permissive shortcuts.