Skip to main content
Machine authentication uses a signing key and an approved OAuth resource grant. Use the OAuth client key management flow to replace it. For a planned key change, register the replacement public JWK through the client’s key management flow and complete the required proof of possession. Configure the workload’s signer and key ID to match the replacement, then verify token exchange and a protected resource request before retiring the previous key where supported. Verify the old key is retired after the replacement is working. With the built-in signer, configure MUDRAID_PRIVATE_KEY_PATH and MUDRAID_KEY_ID (or the corresponding custom prefix). The loader reads the key when constructing the client; recreate the client after changing that configuration. A custom signer owns its own key lifecycle. If a key may be compromised, use the available authorized client/key containment controls and verify the resulting enforcement state. Replacing a local key file alone does not revoke the previous public key or already-issued access tokens. Offline token validation may accept an issued token until expiry; live enforcement behavior must be verified for the integration. Restore access through the relevant enforcement workflow rather than bypassing an existing hold. See Configuration and Agent identity.