A module representing the tenant's cryptographic keys on Auth0.
Auth0 groups three unrelated kinds of key under /keys:
- Application signing keys sign the JWTs your tenant issues. Rotating them is routine hygiene
- Encryption keys protect tenant data at rest, and support bringing your own root key
- Custom signing keys let you supply the signing material yourself rather than using Auth0's
The function names keep them apart; they are not interchangeable.
Summary
Functions
Creates an encryption key.
Requests a public wrapping key for a customer-provided root key.
Gets the custom signing keys, if the tenant supplies its own
Removes the custom signing keys, returning the tenant to Auth0-managed signing
Deletes an encryption key
Gets one encryption key by its key id
Lists the tenant's encryption keys
Imports key material wrapped with the key from create_wrapping_key/1.
Rekeys the tenant, re-encrypting its data under a new key
Replaces the custom signing keys.
Revokes an application signing key.
Rotates the application signing key.
Gets one application signing key by its key id
Lists the application signing keys, including which is current and which are revoked
Functions
Creates an encryption key.
type is required — "customer-provided-root-key" to bring your own, or
"tenant-encryption-key" for one Auth0 generates.
iex> Auth0Client.Management.Key.create_encryption_key(%{type: "tenant-encryption-key"})Requests a public wrapping key for a customer-provided root key.
First half of bringing your own key: fetch this wrapping key, encrypt your key
material with it, then hand the result to import_encryption_key/2.
iex> Auth0Client.Management.Key.create_wrapping_key("abc123")Gets the custom signing keys, if the tenant supplies its own
iex> Auth0Client.Management.Key.custom_signing_keys()Removes the custom signing keys, returning the tenant to Auth0-managed signing
iex> Auth0Client.Management.Key.delete_custom_signing_keys()Deletes an encryption key
iex> Auth0Client.Management.Key.delete_encryption_key("abc123")Gets one encryption key by its key id
iex> Auth0Client.Management.Key.encryption_key("abc123")Lists the tenant's encryption keys
iex> Auth0Client.Management.Key.encryption_keys()
iex> Auth0Client.Management.Key.encryption_keys(per_page: 50, include_totals: true)Imports key material wrapped with the key from create_wrapping_key/1.
Second half of bringing your own key.
iex> Auth0Client.Management.Key.import_encryption_key("abc123", "base64-wrapped-material")Rekeys the tenant, re-encrypting its data under a new key
iex> Auth0Client.Management.Key.rekey()Replaces the custom signing keys.
Takes a list of JWKs, wrapped under keys for you. This replaces the whole set
rather than adding to it.
iex> Auth0Client.Management.Key.replace_custom_signing_keys([%{kty: "RSA", kid: "abc", use: "sig"}])Revokes an application signing key.
Every token signed with it stops being accepted immediately. See
rotate_signing_key/0 for the safe ordering.
Auth0 uses PUT here rather than POST or DELETE.
iex> Auth0Client.Management.Key.revoke_signing_key("abc123")Rotates the application signing key.
The new key signs everything from now on. Tokens already signed with the previous
key stay valid until that key is revoked, which is what makes rotation safe: the
order is rotate, wait for outstanding tokens to expire, then
revoke_signing_key/1. Revoking before they expire rejects every token still in
circulation.
iex> Auth0Client.Management.Key.rotate_signing_key()Gets one application signing key by its key id
iex> Auth0Client.Management.Key.signing_key("abc123")Lists the application signing keys, including which is current and which are revoked
iex> Auth0Client.Management.Key.signing_keys()