---
title: "Rotate the issuer signing key"
method: POST
path: "/v1/keys/rotate"
tags: ["Issuer Keys"]
---

# Rotate the issuer signing key

`POST /v1/keys/rotate`

Rotate your issuer signing key. You can send `overlap_days` to choose how long credentials signed by the previous key keep verifying. New credentials use the new active key immediately.

## Request body

- object
  - `overlap_days` integer — Number of days the previous key remains valid after rotation. Use this to control the overlap window for credentials already signed by that key.

## Response `201`

The rotation result, including the new key, the rotated key, the requested overlap window, and the impact summary.

- object
  - `new_key` object — The new signing key. The service uses this key to sign credentials after rotation.
    - `id` string, uuid — Internal UUID of the new signing-key record.
    - `kid` string — JWK (JSON Web Key) key identifier for the new active key. Credentials issued after rotation carry this `kid` in their SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) header.
    - `alg` 'ES256' — JSON Web Signature algorithm used by the new key.
    - `status` 'active' — Lifecycle state of the new key after rotation.
    - `is_active` boolean — Whether this key is the current signing key.
    - `valid_until` string, date-time, nullable — Validity expiry for the key. The active key returns null.
    - `created_at` string, date-time — Timestamp when the new key was created.
  - `rotated_key` object — The previous active signing key after the service demotes it to `rotated`. Credentials already signed by this key keep verifying until `valid_until`.
    - `id` string, uuid — Internal UUID of the rotated signing-key record.
    - `kid` string — JWK (JSON Web Key) key identifier for the rotated key. Credentials signed before rotation carry this `kid` in their SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) header.
    - `alg` 'ES256' — JSON Web Signature algorithm used by the rotated key.
    - `status` 'rotated' — Lifecycle state of the previous active key after rotation.
    - `is_active` boolean — Whether this key is the current signing key.
    - `valid_until` string, date-time — Timestamp until which the rotated key remains valid for verification.
    - `created_at` string, date-time — Timestamp when the rotated key was created.
  - `overlap_days` integer — Number of days the rotated key remains valid for credentials signed before rotation.
  - `impact` object — Summary of how the rotation affects credentials already signed by the previous key.
    - `credentials_under_previous_key` integer — Count of credentials signed by the previous key when you rotated it.
    - `note` string — Human-readable explanation of the overlap window after rotation.

---

[API](https://skmtc.net/didit-protocol/apis/didit-credentials-api.md) · [All operations](https://skmtc.net/didit-protocol/apis/didit-credentials-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/didit-protocol/didit-credentials-api/revisions/e4eddba66557/schema)