Projection Signing
What this screen is for
Projection signing holds one value: how often the platform rotates, on its own, the key that signs the authorization data its services share and every platform-settings change. The keys themselves, and the rotate and revoke actions, are on the Projection signing keys screen.
What must exist first
- The permission to read platform configuration, which shows the value. The built-in platform administrator, auditor and viewer roles hold it.
- The permission to write platform configuration, to change it. Only the built-in platform administrator holds it.
Decisions you make here
The rotation period
Rotation period is the age, in days, at which the signing key is replaced automatically: 90 unless changed, and any whole number from 1 to 365. A value outside that range is refused when you save. A change applies without a restart, from the platform's next check.
A rotation never makes a service refuse a value: the next key is published to every service before it signs, every value is re-signed under it, and the previous key stays published until that re-sign has finished. A shorter period limits how long one key signs, and so how much a leaked key could forge before it is replaced.
When not to use it
A suspected key disclosure is not answered by shortening the period. Revoke the key on the Projection signing keys screen instead: that takes effect at once.