Projection Signing
What this screen is for
Projection signing holds one value: how often the platform rotates, on its own, the key that signs the authorization data its services share and every platform-settings change. The keys themselves, and the rotate and revoke actions, are on the Projection signing keys screen.
What must exist first
- The permission to read platform configuration, which shows the value. The platform super administrator, auditor and viewer roles hold it.
- The permission to write platform configuration, to change it. Only the platform super administrator holds it.
Decisions you make here
The rotation period
Rotation period is the age, in days, at which the signing key is replaced automatically: 90 unless changed, and any whole number from 1 to 365. A value outside that range is refused when you save. A change applies without a restart, from the platform's next check.
A rotation never makes a service refuse a value: the next key is published to every service before it signs, every value is re-signed under it, and the previous key stays published until that re-sign has finished. A shorter period limits how long one key signs, and so how much a leaked key could forge before it is replaced.
When not to use it
A suspected key disclosure is not answered by shortening the period. Revoke the key on the Projection signing keys screen instead: that takes effect at once.