/v1/account/signing_keys/{id}/rotate
API Key
Rotate a signing key
Rotate a signing key by revoking the old key and creating a new one.
Only active keys can be rotated. The new key inherits the same algorithm
unless specified otherwise.
Parameters
| Name | Location | Type | Description |
|---|---|---|---|
id
*
|
path | string | Signing key ID or key_id |
X-API-Key
*
|
header | string | API key for authentication |
* Required parameter
Request Body
Parameters for rotating a signing key
algorithm
string
Algorithm for new key (default: same as old key)
Allowed values: "es256", "es384", "ed25519"
Example: es256
Response
Content-Type: application/json
success
boolean
data
object
Result of key rotation
message
string
Example: Key rotated successfully. Old key marked as legacy and will be auto-revoked after grace period.
old_key
object
A cryptographic signing key for verifiable credentials
key_id
*
string
Unique key identifier
Example: key-2962d38d-4ec8-454b-82b6-c553c37da055
algorithm
*
string
Cryptographic algorithm (ES256, ES384, or Ed25519)
Allowed values: "es256", "es384", "ed25519"
Example: es256
status
*
string
Key lifecycle status
Allowed values: "pending", "active", "revoked", "expired"
Example: active
usable
*
boolean
Whether the key can be used for signing (active and not expired)
Example: true
legacy
*
boolean
Whether the key has been rotated and is in legacy grace period
expires_at
string (date-time)
nullable
When the key expires (null = no expiration)
created_at
*
string (date-time)
When the key was created
Example: 2025-01-01T00:00:00Z
updated_at
*
string (date-time)
When the key was last updated
Example: 2025-01-01T00:00:00Z
new_key
object
A cryptographic signing key for verifiable credentials
key_id
*
string
Unique key identifier
Example: key-2962d38d-4ec8-454b-82b6-c553c37da055
algorithm
*
string
Cryptographic algorithm (ES256, ES384, or Ed25519)
Allowed values: "es256", "es384", "ed25519"
Example: es256
status
*
string
Key lifecycle status
Allowed values: "pending", "active", "revoked", "expired"
Example: active
usable
*
boolean
Whether the key can be used for signing (active and not expired)
Example: true
legacy
*
boolean
Whether the key has been rotated and is in legacy grace period
expires_at
string (date-time)
nullable
When the key expires (null = no expiration)
created_at
*
string (date-time)
When the key was created
Example: 2025-01-01T00:00:00Z
updated_at
*
string (date-time)
When the key was last updated
Example: 2025-01-01T00:00:00Z
Code Examples
import os
from aho_sdk import AhoSdk
client = AhoSdk.account(api_key=os.environ["AHO_API_KEY"])
result = client.signing_keys.rotate(
id="example_id",
body={
"algorithm": "es256"
}
)client = AhoSdk.account(api_key: ENV["AHO_API_KEY"])
result = client.signing_keys.rotate(
id: "example_id",
body: {
algorithm: "es256"
}
)import { AhoSdk } from '@aho/sdk';
const client = AhoSdk.account({ apiKey: process.env.AHO_API_KEY });
const result = await client.signing_keys.rotate({
id: "example_id",
body: {
algorithm: "es256"
}
});curl -X POST 'https://api.aho.com/v1/account/signing_keys/example_id/rotate' \
-H 'X-API-Key: $AHO_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
"algorithm": "es256"
}'Try It
Log in to test this endpoint directly from the documentation.
Log in