Skip to content

Projection Signing Keys

What this screen is for

Projection signing keys shows the keys that sign the authorization data the platform shares between its services — grants, policies, key-protection labels, statuses — and every platform-settings change, and lets a platform super administrator rotate them on demand or withdraw one after a suspected disclosure.

Only the administration service holds these keys. Every other service checks each value against the public keys the platform publishes, so no other service can produce a value the platform would accept.

You do not have to do anything here for rotation to happen. The platform rotates on its own schedule, re-signs every value under the new key, and removes the old key once that re-sign is complete; this screen shows you where that cycle stands.

What must exist first

  • You work in the platform context. A request from a customer tenant is refused whatever permissions it carries.
  • The permission to read the projection signing keys, held by the built-in platform administrator, operator, auditor and viewer roles, fills the table.
  • The permission to manage them turns on Rotate now and Revoke. Only the built-in platform super administrator holds it. Without it the screen says it is read-only.
  • A bound key-protection backend. The keys are sealed by it; while it is not bound, the screen can neither read nor change them and tells you to bind it under HSM / Cloud KMS.

Decisions you make here

Reading the table

Each row is one published key, with its state, its key ID (kid), its algorithm and the instants the server computed:

  • Next — published, not signing yet. It becomes the signing key at the next rotation.
  • Active — the one key signing now. Signing since is when it was promoted. Its re-sign column says whether every value has been re-signed under it yet.
  • Previous — no longer signing. It stays published until every value it signed has been re-signed under the Active key; the screen then says from when it may leave the set, and the platform retires it at its next check.

The screen never computes a date itself, and Refresh reads every instant again from the server.

Rotating now

Rotate now promotes the Next key, turns the Active key into a Previous key, and publishes a fresh Next key, in one step. Every value is then re-signed under the new key, and no service refuses a value during the rotation.

It is available only from the instant the screen states: a Next key must have been published for a few minutes first, so that every service already holds it. Asking earlier is refused and nothing changes.

You rarely need it: the platform rotates by itself when the Active key reaches the age set under Projection signing in this group (90 days unless changed).

Revoking a key

Revoke withdraws one key from the set at once. It is for an incident, not for routine rotation. It asks for a reason, recorded in the signed audit event and at most 1,000 bytes, and then shows what revoking this key does before you confirm.

  • Active — the Next key starts signing immediately and a new Next key is published. Every value the revoked key signed is refused by every service until it has been re-signed under the new key, so operations that depend on those values are denied for a short while.
  • Next — it has signed nothing; a fresh Next key replaces it and nothing is refused.
  • Previous — any value it still signs is refused until it has been re-signed under the Active key.

A revoked key is removed, not demoted, and cannot be restored. Services drop it as soon as they are told the set changed.

When another change got there first

Only one change to the key set is committed at a time. If the platform's own schedule, or another administrator, changed the set between your reading and your action, your action is refused, nothing changes, and the screen reads the set again for you to check.

A revocation also checks the key's state. If a rotation moved the key first, the revocation is refused and nothing changes; the screen shows the key's current state and what revoking it would now do. Nothing is sent again for you: decide again, and confirm if the revocation is still what you want.

How it relates to other screens

The age at which the platform rotates these keys by itself:

The keys that sign user access tokens, the backend that seals both key sets, and the rest of this group:

Where to read more