oz0 tenant oidc rotate
Usage and flags for oz0 tenant oidc rotate.
For: Operators and developers looking up a command.
The issuer's key set always holds the previous, the current and the next key, so the next key was published before it signs and tokens signed a moment ago still verify. A rotation is refused within two hours of the last one, so that verifiers that cache the key set for up to an hour never meet a key they have not seen.
--emergency skips one key, so the current key, which may have leaked, leaves the key set at once; verifiers that cached it keep trusting it until their cache ends.
Usage
oz0 tenant oidc rotate <tenant> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--emergency | bool | skip a key, so the current one leaves the key set at once (allowed at any time) | |
--json | bool | print JSON | |
--reason | string | why, required (at most 500 characters; default $OZ0_REASON); the audit log keeps it |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.