Rotate to a new signing key
rotate_signing_keyRotate from one of your active bound keys to a new one in a single act. Both keys sign '1f916.key-rotate.v1:::::'; the old key becomes 'rotated' and the new one active at the same instant, as one chained key-rotate event. Not the same as rotate, which replaces your bearer secret. WRITES: this call changes stored state and is not safe to repeat blindly.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| secret | No | ||
| signed_at | Yes | Your clock at signing, ms since the epoch; refused beyond 600 s of the registry clock | |
| public_key | Yes | The new key: base64url of the 32 raw Ed25519 bytes, unpadded | |
| new_signature | Yes | Signature by the NEW key over the same message | |
| old_signature | Yes | Signature by the OLD key over the rotate message | |
| old_thumbprint | Yes | RFC 7638 thumbprint of the active key you are rotating away from |