Key rotation

#!/usr/bin/env bash
set -euo pipefail
API=https://api.opentype.dev
AUTH="Authorization: Bearer $OPENTYPE_API_KEY"
OLD_KEY_ID=key_d92a9043204d41c09c78fc813d54ef06

# 1. Create the replacement with the same scopes as the old key.
scopes=$(curl -sS "$API/v1/keys/$OLD_KEY_ID" -H "$AUTH" | jq -c '.scopes')
new=$(curl -sS "$API/v1/keys" -X POST -H "$AUTH" -H "Content-Type: application/json" \
  -d "{\"name\": \"ticket-router-prod-$(date -u +%Y-%m)\", \"scopes\": $scopes}")
echo "$new" | jq -r '.secret' > new-secret.txt   # move this into your secret store, then delete the file
echo "new key: $(echo "$new" | jq -r '.id')"

# 2. Deploy the new secret, then check the old key has gone quiet.
curl -sS "$API/v1/keys/$OLD_KEY_ID" -H "$AUTH" | jq '{last_used_at}'

# 3. Revoke the old key.
curl -sS "$API/v1/keys/$OLD_KEY_ID" -X DELETE -H "$AUTH" | jq '{id, state, revoked_at}'

const API = "https://api.opentype.dev";
const headers = {
  Authorization: `Bearer ${process.env.OPENTYPE_API_KEY}`,
  "Content-Type": "application/json",
};

async function call(method: string, path: string, body?: unknown) {
  const res = await fetch(`${API}${path}`, {
    method,
    headers,
    body: body === undefined ? undefined : JSON.stringify(body),
  });
  if (!res.ok) throw new Error(`${method} ${path}: ${res.status} ${await res.text()}`);
  return res.json();
}

// Step 1: create the replacement with the same scopes.
export async function createReplacement(oldKeyId: string, name: string) {
  const old = await call("GET", `/v1/keys/${oldKeyId}`);
  const created = await call("POST", "/v1/keys", { name, scopes: old.scopes });
  return { id: created.id as string, secret: created.secret as string }; // store the secret now
}

// Step 2, after deploying: true once the old key has not been used for `quietMs`.
export async function isIdle(oldKeyId: string, quietMs = 10 * 60_000) {
  const old = await call("GET", `/v1/keys/${oldKeyId}`);
  return old.last_used_at === null || Date.now() - Date.parse(old.last_used_at) > quietMs;
}

// Step 3: revoke. Safe to call twice.
export async function revoke(oldKeyId: string) {
  const revoked = await call("DELETE", `/v1/keys/${oldKeyId}`);
  return revoked.revoked_at as string;
}

import os
from datetime import datetime, timezone

import requests

API = "https://api.opentype.dev"
HEADERS = {"Authorization": f"Bearer {os.environ['OPENTYPE_API_KEY']}"}


def call(method, path, body=None):
    res = requests.request(method, f"{API}{path}", headers=HEADERS, json=body, timeout=30)
    if not res.ok:
        raise RuntimeError(f"{method} {path}: {res.status_code} {res.text}")
    return res.json()


def create_replacement(old_key_id, name):
    """Step 1: create the replacement with the same scopes. Store the secret now."""
    old = call("GET", f"/v1/keys/{old_key_id}")
    created = call("POST", "/v1/keys", {"name": name, "scopes": old["scopes"]})
    return created["id"], created["secret"]


def is_idle(old_key_id, quiet_s=600):
    """Step 2, after deploying: True once the old key has not been used for quiet_s seconds."""
    last = call("GET", f"/v1/keys/{old_key_id}")["last_used_at"]
    if last is None:
        return True
    used = datetime.strptime(last, "%Y-%m-%dT%H:%M:%SZ").replace(tzinfo=timezone.utc)
    return (datetime.now(timezone.utc) - used).total_seconds() > quiet_s


def revoke(old_key_id):
    """Step 3: revoke. Safe to call twice."""
    return call("DELETE", f"/v1/keys/{old_key_id}")["revoked_at"]

curl -sS https://api.opentype.dev/v1/keys/key_d92a9043204d41c09c78fc813d54ef06/rotate \
  -X POST \
  -H "Authorization: Bearer $OPENTYPE_API_KEY"

const keyId = "key_d92a9043204d41c09c78fc813d54ef06";
const res = await fetch(`https://api.opentype.dev/v1/keys/${keyId}/rotate`, {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.OPENTYPE_API_KEY}` },
});
if (res.status === 409) throw new Error("key is revoked: create a new key instead");
if (!res.ok) throw new Error(`rotate failed: ${res.status}`);
const { secret } = await res.json(); // shown only in this response

import os
import requests

key_id = "key_d92a9043204d41c09c78fc813d54ef06"
res = requests.post(
    f"https://api.opentype.dev/v1/keys/{key_id}/rotate",
    headers={"Authorization": f"Bearer {os.environ['OPENTYPE_API_KEY']}"},
    timeout=30,
)
if res.status_code == 409:
    raise RuntimeError("key is revoked: create a new key instead")
res.raise_for_status()
secret = res.json()["secret"]  # shown only in this response