See openid-connect Menu
  1. Home >
  2. OpenId Connect >
  3. API Reference - Latest >
  4. Rotate Signing Key

Rotate Signing Key

Use this API endpoint to create a new Signing Key.

OneLogin recommends that you rotate your signing keys every 90 days so that in the event of a security breach you can rotate keys with the confidence that all of your OpenId Connect applications are configured correctly to automatically switch over to the new keys.

Generally speaking if you are using a certified OpenId Connect client it will be able to handle both new keys and those that have been rotated into a draining state.

This API request will create a new Signing Key with an active state and force all existing keys to a draining state.

All tokens issued after a new Signing Key has been created will use that key for thier signature.

Existing keys that move to the draining state will remain in the keys list and can still be used to validate tokens.

To remove keys in the draining state see the Revoke Signing Key endpoint.




Resource URL

https://<subdomain>.onelogin.com/oidc/2/signing_keys

Header Parameters

Authorization

required

string

Set to bearer <access_token>.

Set <access_token> to the access token you generated using the Generate Token API.

The access token must have been generated using an API credential pair created using the scope required to call this API. This API can be called using any one of the following scopes: Manage All.

Request Body

There are no parameters to be sent with this request.

Sample Responses

  • 200 OK
  • 401 Unauthorized

Returns the newly created Signing Key.

{
    "kid": "ZoKMCcDDtLHKYPyZnXSDKTMmknGltey7M09CQy3RCIE",
    "status": "active",
    "kty": "RSA",
    "use": "sig",
    "n": "vy-2haKstl8Q5WSzxYLCAEqGRYgC1RgNeKifGOusvb_N82sf9iD7CUfJKQnfKU7sm3aEXIRE0YQTlwxVRIxRDYpljyfHE91mn0UWSs8gs2XwqNg8S7lNNrWCF6rQoX8asc2DvsE7g8jD606xs-nSGHOsYrZyD_HS2IcTUOHmCRQ9LMPPiuVfE06zV8A77zWG_lf7Mg46rY_uE5nDgzk-NKHvrhwZPrKjUc2d_DEqTPatG4ELxT0v-ZJLv1ysda8v1aJ1StG8Q2z3tpQZQPKjSEGZDKTPH6OdEgJwcZrCSeyx86I9ZC31AeGegnGbgqIU9a9EA0PZdWiQswc0_en-Mw",
    "e": "AQAB"
}

Typically, this error means that your access token value is invalid.

{
    "message": "Unauthorized",
    "statusCode": 401,
    "name": "UnauthorizedError"
}

Postman Collection

Replace sample variables indicated by {{ }} with your actual values.

Download for the OpenId Connect API

Sample Code

cURL

Replace sample values indicated by < > with your actual values.

List Mappings

curl 'https://<subdomain>.onelogin.com/oidc/2/signing_keys' \
-X POST \
-H "Authorization: bearer <access_token>"

Have a Question?

Found a problem or a bug? Submit a support ticket.

Looking for walkthroughs or how-to guides on OneLogin's user and admin features? Check out the documentation in our Knowledge Base.

Have a product idea or request? Share it with us in our Ideas Portal.