Not yet available

This command is planned for a future release.

culvii key rotate

Generate a replacement key with identical scope, workspace, and environment.

Synopsis

culvii key rotate <fingerprint-or-name>

Description

Generates a replacement key with identical scope, workspace, and environment. Both the old key and the new key remain valid simultaneously for 24 hours (the overlap window). This ensures zero-downtime rotation — in-flight CI pipelines continue on the old key while consumers are updated to the new one.

After 24 hours, the old key is automatically revoked by the platform. Monitor last_used_at on the old key to confirm no consumers are still using it before relying on auto-revocation.

Requires an OAuth session.

Arguments

Argument	Description
<fingerprint-or-name>	The fingerprint (e.g. a3f9...8c2d) or name of the key to rotate.

Examples

culvii key rotate a3f9...8c2d
# → Created replacement: ck_dev_b7e2_3d91 (same scope, env, workspace)
# → Both keys are currently active.
# → Old key (a3f9...8c2d) auto-revokes in 24 hours. Update your consumers, then verify.
#
# ⚠  Save this secret now. It will not be shown again.
# ck_dev_b7e2_<rest_of_secret>

Error behaviour

Condition	Status	Message
Key not found	404	"Key not found."
Key already revoked	409	"Cannot rotate a revoked key. Create a new key instead."
Not authenticated	401	"Run culvii login first."

Related commands

culvii key create, culvii key revoke, culvii key list