Rotate API keys

With this method, you can have a single OAuth API key with multiple public keys associated with it.

1. Log in to the Redox dashboard.
2. From the navigation menu, select the Developer page.
3. By default, the Sources tab opens and displays any configured sources and OAuth API keys. Click the Edit button for the API key that you want to rotate.
4. The Settings page of the API key displays with the details. Click the Provide your public key tab.
5. Two fields display on this tab. In the Option 2: Provide or edit your JWKS entry field, add the new JWK to the keys array without deleting the old one yet.

   
6. The keys array now has two objects, the old JWK and the new JWK (like in the code example below). Click the Save button.

   Example: Two entries in keys array

   json

   Copy

   1
   {
   2
     "keys": [
   3
       {
   4
         "kid": "old-key-id",
   5
         "kty": "RSA",
   6
         ...
   7
       },
   8
       {
   9
         "kid": "new-key-id",
   10
         "kty": "RSA",
   11
         ...
   12
       }
   13
     ]
   14
   }
7. Update your system to use the new JWK. That means you must update the private key and the key ID (i.e., kid). Don’t update the client ID.
8. Once your system is updated, return to the API key settings in the Redox dashboard. Delete the old JWK from the keys array. Keep the new one.
9. Click the Save button.

With this method, you can use multiple OAuth API keys with unique public keys associated with each one.

1. Follow the steps for creating a new OAuth API key.
2. Once you have a new OAuth API key, update your system to use the new JWK. That means you must update the private key, key ID (i.e., kid), and client ID values.
3. Once your system is updated, return to the API key settings in the Redox dashboard. Delete the old OAuth API key. Follow the steps for deleting an API key, if you need to.