Key rotation

Learn about key rotation.

Read time 1 minute

Last updated 8 months ago

According to security best practices, it is recommended that you rotate the token signing key on a periodic basis (typically monthly). The Vivox system allows each issuer to have two keys active simultaneously, which you can use to rotate keys with no interruption in service.

To perform key rotation, complete the following steps:

Obtain the time to live that is used when generating access tokens.

(For demonstration purposes, this example uses "TTL" as this value.)

Add your new key by using the included vivox_admin.py code as follows:


python vivox_admin.py add_key -shttps://assigned_subdomain.www.vivox.com/api2/ -u your_admin_username -pyour_admin_password -i your_issuer -k your_new_key

Change your game server to begin issuing tokens by using the new key.
Wait for a period of 2*TTL seconds.

Remove your old key by using the included vivox_admin.py code as follows:


python vivox_admin.py revoke_key -shttps://assigned_subdomain.www.vivox.com/api2/ -u your_admin_username -pyour_admin_password -i your_issuer -k your_old_key

Documentation

Development

User Acquisition

Monetization

Industry