# Signing keys

A `SigningKey` is a built-in secret type for the key that sessions and
tokens are signed with: at least 32 characters, with no spaces.
Authentication reads it as `signing_key: config.session_signing_key`. When
your app sets a revocation delay, it signs sessions and tokens with that key
([The application and revocation](the-application-and-revocation.md)).

A `SigningKey` setting reads its variable and, when that is set,
`<NAME>_PREVIOUS` as well: `session_signing_key` reads
`SESSION_SIGNING_KEY` and `SESSION_SIGNING_KEY_PREVIOUS`. New tokens are
signed with the current key, and tokens signed with either key are
accepted. So to rotate a key, set the new one and move the old one to
`_PREVIOUS`. Remove the old one once the longest token lifetime has passed.
Both keys are checked when the app starts, and neither is ever printed.