Roll a signing key in four steps: publish the new public key alongside the old one, start signing with the new key, wait until every token or signature made with the old key has expired, then remove the old public key. Tag each signature with a key ID so verifiers pick the right key.
Why a key ID helps
RFC 7517 defines the kid parameter for JSON Web Keys. It is used to match a specific key and, in the spec's words, helps choose among a set of keys within a JWK Set during key rollover. Keys in a set should use distinct kid values so the lookup is unambiguous.
A verifier reads the kid from the signature header, finds the matching public key in the published set and verifies with it. During rollover the set holds two keys, so both old and new signatures verify.
The rollover sequence
- Generate the new key pair in your key service. Keep the private key where the old one lives.
- Publish the new public key in the key set. Do not sign with it yet. Give caching clients time to fetch the update.
- Switch signing to the new key. New signatures carry the new kid.
- Keep the old public key published until the longest lifetime of anything it signed has passed, plus a margin.
- Remove the old public key and destroy or archive the old private key per your policy.
The wait in step 2 is the one teams skip. If you sign first, clients with a cached key set reject valid tokens until their cache refreshes.
Plan for the clients
- Say how long clients may cache your key set, and respect it in the response headers.
- On an unknown kid, a verifier should refetch the set once, with a rate limit, before failing.
- Never let a token choose a key location or fetch a key from a URL it carries. Strict validation of kid and key sources matters. See JWT kid and jku header injection.
Emergency rollover
If a private key leaks, skip the overlap. Remove the old public key at once and accept that live tokens fail, then reissue. Having a rehearsed key compromise plan makes this a procedure instead of a scramble.
Rotation schedule
Pick a rotation interval you can actually sustain, and rehearse it. A rotation done every few months with automation beats one planned yearly and never practiced. See how often to rotate keys.
Quick check
Do I need to re-sign old tokens after rollover?
No. Old tokens stay valid until they expire, as long as the old public key remains published.
Does this only apply to JWTs?
No. Signed packages, firmware, webhooks and certificates all benefit from the same overlap pattern.
Sources
Last reviewed: 19 October 2026.
