Skip to main content
Both routes require a system-scoped session with sys.settings.manage:
The list response includes key id, primary state, creation time, and retirement time. The response never returns raw key bytes. Rotation creates a new primary key and retires the previous primary while the service keeps the active verification set needed for the rotation window. Store fixed bootstrap material outside TOML with MS_AUTH_JWT_SECRET_OVERRIDE only when required by deployment policy.
Last modified on August 4, 2026