Skip to main content
PipesHub signs sessions and tokens with three secrets: the JWT secret, the scoped JWT secret (for calls between its own services) and the cookie secret. They are generated on first start and stored in the key-value store. Upgrades never replace them. Rotate them if you think they have leaked, or as part of a regular secret rotation.
Rotation signs everyone out. Every session and refresh token stops working, password-reset links already sent stop working, and service-to-service tokens in flight are no longer accepted.

​
Docker Compose

From the install directory:
The installer asks you to type ROTATE to confirm. Add --yes to skip the prompt in a script. It then:
  1. Writes a new random ROTATE_SIGNING_SECRETS id to .env.
  2. Recreates the pipeshub-ai container without pulling new images.
  3. On start, the app sees an id it has not applied before and generates new secrets.
  4. Waits for the health check, as an install does.
To rotate while you upgrade, combine the flags:
--rotate-signing-secrets needs an existing .env. It cannot be combined with --stop or --uninstall.
JWT_SECRET, SCOPED_JWT_SECRET and COOKIE_SECRET in .env only seed a fresh install. Changing them later does nothing. Use the rotate flag.

​
Kubernetes

The chart has no rotation setting of its own. Pass a new, never-used value of ROTATE_SIGNING_SECRETS to the app through extraEnv, then let the pods restart:
The app rotates once for each new value. Keep the value in your values file afterwards; removing it does not undo the rotation.

​
After rotating

  • Everyone signs in again.
  • Check that integrations that call the API still work, and re-issue their credentials if they do not.