Rotate JWT signing keys - MoleSignal Docs

[
  {
    "id": "3JtcPZ3AZJFyvBvSkJUia0N7wqo",
    "is_primary": true,
    "created_at_micros": 1790000000000000,
    "retired_at_micros": null
  }
]

[
  {
    "id": "3JtcPZ3AZJFyvBvSkJUia0N7wqo",
    "is_primary": true,
    "created_at_micros": 1790000000000000,
    "retired_at_micros": null
  }
]

Both routes require a system-scoped session with sys.settings.manage. An organization-scoped token receives 403. Get a system-scoped token with Select a workspace for the _sys organization.

List signing keys

GET /api/v1/auth/jwt/secrets

Returns the metadata of the signing keys. Raw key bytes are never returned.

[
  {
    "id": "3JtcPZ3AZJFyvBvSkJUia0N7wqo",
    "is_primary": true,
    "created_at_micros": 1790000000000000,
    "retired_at_micros": null
  }
]

Rotate

POST /api/v1/auth/jwt/rotate

Creates a new primary key and retires the previous primary. New tokens are signed with the new key. Tokens signed with a retired key stay valid for 24 hours after the retirement.

{
  "new_kid": "<new-key-id>",
  "retired_kid": "<previous-key-id>",
  "active_count": 2
}

active_count is the number of keys that currently verify tokens. A deployment that pins the signing key with MS_AUTH_JWT_SECRET_OVERRIDE follows its own rotation policy. See Security and multi-tenancy.

Last modified on October 9, 2026