> For the complete documentation index, see [llms.txt](https://docs.corppass.gov.sg/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.corppass.gov.sg/what-you-need-to-know-before-onboarding-a-digital-service-in-corppass/important-things-to-note/key-rotation.md).

# Key Rotation

### **How do I rotate my JWKS keys?**

The process for rotating your JWKS keys depends on where they are hosted:

**If your JWKS is hosted on your own endpoint:**

* You can rotate your keys **at any time** without notifying Corppass.
* Ensure your system dynamically recognizes the new keys by using the `"kid"` (Key ID) field.

**If your JWKS is stored as a JWKS Object with Corppass:**

1. **Submit your new keys** to Corppass for an update.
2. Corppass will **add the new keys to the keyset** while temporarily retaining the old keys.
3. Ensure your application dynamically selects the correct key for decryption using the `"kid"` field.
4. **Test the new keyset** to confirm successful integration.
5. Once verified, Corppass will **remove the old keys** from the system.

By following this process, you ensure a smooth key transition without service disruptions.

***

### **What should I do if my encryption key needs to be rotated?**

To ensure zero-downtime key rotation, follow these steps:

1. **Generate a new encryption key pair (K2)** while keeping the existing key (K1) active.
2. **Add K2 to your JWKS** while retaining K1.
3. **Wait at least 1 hour** to allow Corppass to retrieve the new key.
4. **Verify that Corppass is using K2** before removing K1 from the JWKS.

This process ensures that encryption remains uninterrupted during the transition.

***

### **Does Corppass require both signing and encryption keys?**

Yes, Corppass requires both:

* A **signing key (EC)** for validating client assertions.
* An **encryption key (EC or RSA)** for encrypting ID tokens.

⚠ **Note:** RSA encryption keys are **deprecated** but still supported for backward compatibility. New implementations should use EC encryption keys.