Signing keys

A SigningKey is a built-in secret type for the key that sessions and tokens are signed with: at least 32 characters, with no spaces. Authentication reads it as signing_key: config.session_signing_key. When your app sets a revocation delay, it signs sessions and tokens with that key (The application and revocation).

A SigningKey setting reads its variable and, when that is set, <NAME>_PREVIOUS as well: session_signing_key reads SESSION_SIGNING_KEY and SESSION_SIGNING_KEY_PREVIOUS. New tokens are signed with the current key, and tokens signed with either key are accepted. So to rotate a key, set the new one and move the old one to _PREVIOUS. Remove the old one once the longest token lifetime has passed. Both keys are checked when the app starts, and neither is ever printed.