Documentation/Developers
Back
  • Getting started
    • Frontends and app types
    • Environments and endpoints
  • OAuth clients
    • Client ID and secret
    • Redirect URIs and start URL
    • Secret rotation
  • Login with appsolut
    • Authorization code flow
    • Tokens and claims
    • Frontend role
    • Sign-out
    • Revocation and issued tokens
    • Token endpoint errors
  • Frontend keys
    • Issue and store a key
    • Send a key
    • Rotate and revoke
  • Members API
    • Eligibility from a backend
    • The signed-in member
    • Results, rate limits and errors
    • Is an applicant an eligible member?
    • The signed-in frontend user's membership
  • appsolut register API
    • Implement the API
    • Connect and test
    • Verify a member with their challenge code
    • List every member
    • The status of several members
    • The status of one member
    • The person data of several members
    • The person data of one member
    • The claims of several members
    • The claims of one member
    • Health check

Rotate and revoke

Switching to a new frontend key without downtime, and revoking a key.

Studio roles: "Owner", "Administrator", "Frontend manager".

Rotate without downtime

Because a frontend may have two active keys, you can switch keys while the old one keeps working:

  1. Issue a new key ("Issue key") and store it.
  2. Deploy the new key to the frontend's backend.
  3. Check on the "Keys" card that the old key's "Last used" no longer moves.
  4. Revoke the old key.

Rotate when a key may have leaked, when someone who knew it leaves, or on a schedule of your own.

Revoke a key

On the "Keys" card, click "Revoke" beside the key and confirm with "Revoke key". The dialog tells you when the key was last used.

The key stops working at once. From the next request on, the frontend's backend is refused with it, and a revoked key cannot be restored. To rotate without downtime, switch the backend to a new key before you revoke the old one.

Disconnecting the frontend instead

To stop a frontend altogether, the organisation disconnects it ("Disconnect frontend"): its keys stop working too, but they are kept, and reconnecting the frontend makes the same keys work again. Revoke keys you never want to work again.