> ## Documentation Index
> Fetch the complete documentation index at: https://docs.molesignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate JWT signing keys

> List and rotate platform JWT signing-key metadata.

Both routes require a system-scoped session with `sys.settings.manage`:

```http theme={null}
GET  /api/v1/auth/jwt/secrets
POST /api/v1/auth/jwt/rotate
```

The list response includes key id, primary state, creation time, and retirement time. The response never
returns raw key bytes.

Rotation creates a new primary key and retires the previous primary while the service keeps the
active verification set needed for the rotation window. Store fixed bootstrap material outside
TOML with `MS_AUTH_JWT_SECRET_OVERRIDE` only when required by deployment policy.