QSign v2 — Key registry

The registry tracks all HMAC-SHA256 and Ed25519 keys ever used by QSign. Active keys sign new payloads; retired keys stay valid forever for verifying historical signatures. Rotation is admin-gated and creates an overlap window.

Loading…

Rotate a key (admin)

Demotes the current active key to retired and makes the new one active. Retired keys verify historical signatures forever. Token is cached in localStorage — clear browser data after use on shared machines.

Admin bearer token

Algorithm

Notes (optional)

publicKey (64-hex, optional)

secretRef (env var name, optional)

For Ed25519 you must provide one of these — backend refuses silent ephemeral keys. publicKey registers an externally-generated keypair; secretRef tells backend which env var holds the private seed.