Rotate OIDC keys
A new key will be generated and prepend to the list of keys.
Only two recent keys will be kept. The oldest key will be automatically removed if there are more than two keys.
Path parameters
-
keyType
string Required Private keys are used to sign OIDC JWTs. Cookie keys are used to sign OIDC cookies. For clients, they do not need to know private keys to verify OIDC JWTs; they can use public keys from the JWKS endpoint instead.
Values are
private-keys
orcookie-keys
.
Body
Required
-
signingKeyAlgorithm
string The signing key algorithm the new generated private key is using.
Only applicable when
keyType
isprivate-keys
.Values are
RSA
orEC
.
POST
/api/configs/oidc/{keyType}/rotate
curl \
--request POST 'https://[tenant_id].logto.app/api/configs/oidc/{keyType}/rotate' \
--header "Authorization: Bearer $ACCESS_TOKEN" \
--header "Content-Type: application/json" \
--data '{"signingKeyAlgorithm":"RSA"}'
Request examples
{
"signingKeyAlgorithm": "RSA"
}
Response examples (200)
[
{
"id": "string",
"createdAt": 42.0,
"signingKeyAlgorithm": "RSA"
}
]