Back to articles

Tag archive

#licensing

R
Oct 10, 2026

Rotating your license-signing key without bricking the field

Your license keys are signed with a private key, and every copy of your app verifies them against the matching public key it ships. So what happens the day you need a new signing key — a suspected leak, a scheduled rotation, a move to a stronger algorithm? Replace the key naively and either the field stops trusting newly issued licenses or old licenses stop verifying. The answer is a key id (kid) in the signed payload plus a trusted keyset in the SDK, so old and new keys verify side by side during an overlap window. Here is exactly how to shape the kid, carry a multi-key trust store, re-issue the active base, and retire the old key safely.

Oct 10, 20267 min read0 reactions0 comments