Skip to main content
Cipher keys encrypt the fields that streams mark as encrypted. Every key is a 32-byte AES-256-GCM key. MoleSignal wraps the key material with the root key from MS_CIPHER_KEY and never returns it. See Security. New encrypted values always use the latest version of the default key __field_default__, which MoleSignal creates when a stream first needs it. Other named keys, and the earlier versions of every key, keep decrypting the values written with those keys.

​
Key metadata

The list, get, create, and rotate calls return the metadata of key versions. The list returns every version of every key, newest version first within a name.
rotated_at_micros is null for a key that was never rotated. The get call returns the latest version.

​
Create a key

The response is the key metadata shown above.

​
Rotate a key

The body holds key_material_b64, as in the create call. The call adds a version with the new material and keeps the earlier versions for decryption. Rotating a name that does not exist answers 404. Create the key first with the create call.

​
Delete a key

Deletes every version of the named key and answers {"deleted": true}. A name that does not exist answers 404. The call does not check whether stored data still depends on the key.
Values that were encrypted with a deleted key cannot be decrypted again. Check the encrypted fields that depend on a key before deleting it.

​
Rotate the default key

Generates new key material on the server, adds a new version of __field_default__, and refreshes the decryption cache right away. New writes use the new version, and existing values stay readable. When the organization has no default key yet, the call creates it as version 1. The body is empty, and the response holds the identifier and the version of the new key:
Errors
Last modified on October 9, 2026