Rotate credentials

Rotate an API key

Generate a replacement in the Admin dashboard and copy it immediately. Rotation invalidates the previous raw key. Update the secret in your backend, restart or redeploy consumers, and make a test request.

If multiple services share one key, coordinate deployment or ask Genesis about separate integration credentials rather than temporarily placing both keys in client code.

Rotate a signing key

Generate a new keypair in your secure environment, retain the private key, and send Genesis the public JWK and new kid. Coordinate the activation time before issuing tokens with the new key.

Do not reuse a kid for different key material. Remove or disable the old public key after all tokens it signed have expired.

Genesis encryption key changes

Genesis will provide a replacement encryption public key and transition instructions if its JWE recipient key changes. Encrypt new tokens to the announced key on the agreed schedule. No partner private material is required for this change.

Emergency rotation

For suspected compromise, disable the integration or affected capability first, rotate credentials, examine idempotency keys and audit events, and re-enable only after verification. Account links are single-use, but leaked unexpired values should still be treated as incidents.