# Key rotation drill (Phase 3)

**Status:** Ops runbook  
**Date:** 2026-08-12

## Secrets in scope

| Secret | Used by | Rotation impact |
|--------|---------|-----------------|
| `JWT_SECRET` | API token signing | Invalidates existing employee/admin/renter sessions |
| Company API keys | Partner/Carplace integrations | Per-company reissue via admin/API |
| DB / Redis passwords | Compose / managed services | Coordinated restart |
| Object storage keys | S3/MinIO driver | Dual-key period preferred |

## JWT_SECRET drill (staging)

1. Announce maintenance window (sessions will drop).
2. Generate a new high-entropy secret; store in secret manager **before** env change.
3. Update staging `.env` / secret store; rolling-restart API + worker.
4. Confirm:
   - Old bearer tokens return 401
   - Fresh login issues valid tokens
   - `/ready` stays healthy
5. Record time-to-rotate and any customer-facing impact.

## Company API key drill

1. Create a replacement key for a test company.
2. Switch the client to the new key.
3. Revoke/disable the old key.
4. Confirm old key fails; new key succeeds.

## Evidence

| Field | Value |
|-------|-------|
| Date | |
| Environment | staging |
| Secrets rotated | |
| Duration | |
| Issues | |
| Operator | |

Do **not** rotate production secrets without dual-control and a tested rollback path for webhook signing secrets.