Attesto.Keystore.Static (Attesto v0.5.0)

Copy Markdown View Source

A simple Attesto.Keystore backed by application configuration.

Reads its signing material from the :attesto application environment:

config :attesto, Attesto.Keystore.Static,
  signing_pem: System.fetch_env!("OAUTH_SIGNING_PRIVATE_KEY_PEM"),
  # optional; defaults to [signing_pem] when omitted
  verification_pems: [current_pem, previous_pem]

Only signing_pem is required. When verification_pems is omitted, the verification set is exactly the signing key, which is the correct single-key default - and because Attesto derives the public half from the private key, the signing and verifying keys can never drift.

During a rotation, set verification_pems to both the new and old keys while signing_pem points at the new one; once no live tokens were minted under the old key, drop it from the list.

Hosts with their own resolution (a secrets manager, a fail-fast boot check, an HSM) implement Attesto.Keystore directly instead of using this module.