License key rotation

The license key connects an agent server to the account. Every request an agent server makes to Search2o Cloud carries the key, and an agent server without a valid key cannot start. An administrator can replace the key at any time, without downtime.

When to rotate

Rotate the key when it may have been exposed, or on the schedule your security policy sets. The key is a credential like any other: keep it in your secret store, pass it to agent servers through SEARCH2O_LICENSE_KEY, and never write it into a script or an agent. See License key for the two ways an agent server receives it.

How a rotation works

1. On the License page, rotate the key and choose when the old key expires, from 15 minutes to 31 days ahead. A new key is issued and shown once.
2. Restart every agent server with the new key before then, one at a time if preferred. Until the old key expires, agent servers on either key serve the account side by side.
3. An agent server still on the old key stops working when the old key expires.

The License page shows the status of the current key and, during a rotation, when the old key expires. A new rotation cannot start while the old key of a previous rotation is still valid.

Canceling a rotation

If a problem occurs, cancel the rotation while the old key is still valid. The new key is invalidated at once, and the old key stays current. Agent servers already restarted with the new key must be restarted again with the old key.