Skip to content
Internal Engineering Docs

Rotate Secrets

Internal signing keys (trust-kit)

  1. Generate a new 256-bit hex key:
Terminal window
openssl rand -hex 32
  1. Set the new secret in Wrangler for each affected Worker:
Terminal window
echo "<new-key>" | wrangler secret put INTERNAL_SIGNING_KEY --env prod
  1. Update the key in core-platform first, then update dependent Workers within 5 minutes.

API gateway master key

Terminal window
echo "<new-key>" | wrangler secret put GATEWAY_MASTER_KEY --env prod

Payment provider webhooks

Regenerate the signing secret in the payment provider’s dashboard, then update via Wrangler:

Terminal window
echo "<new-webhook-secret>" | wrangler secret put PAYMENT_WEBHOOK_SECRET --env prod

Frequency

Rotate all secrets at minimum every 90 days, or immediately after a suspected compromise.