culvii key rotate
Generate a replacement key with identical scope and workspace.
Synopsis
culvii key rotate <fingerprint> [--env <env>]
Description
Generates a replacement key with identical scope and workspace. Both the old and new key remain valid simultaneously for 24 hours (overlap window) for zero-downtime rotation. After 24 hours, the old key is automatically revoked by the platform.
Requires an OAuth session.
Arguments
| Argument | Description |
|---|---|
<fingerprint> | Fingerprint of the key to rotate. Get it from culvii key list. |
Flags
| Flag | Description |
|---|---|
--env | Target environment. Defaults to active context. |
Examples
culvii key rotate a3f9...8c2d
# → ⚠ Save this secret now. It will NOT be shown again.
# → Secret: ck_dev_b7e2...
# → Fingerprint: b7e2...3d91
# → Old key will be automatically revoked in 24 hours. Update your consumers.
Error behaviour
| Condition | Status | Message |
|---|---|---|
| Fingerprint not found | — | "Error: Key with fingerprint <fp> not found." |
| Key already revoked | 409 | "Cannot rotate a revoked key." |
Related commands
culvii key create, culvii key revoke, culvii key list