License key rotation

The license key is what connects an agent server to the account. Every request an agent server makes to Search2o Cloud carries the key, and a server without a valid key cannot start. An administrator can replace the key at any time, without downtime.

When to rotate

Rotate the key when the key may have been exposed, or on a schedule your security policy sets. The key is a credential like any other: keep it in your secret store, pass it to servers through SEARCH2O_LICENSE_KEY, and never write it into a script or an agent. See License key for the two ways a server receives it.

How a rotation works

1. On the License page, rotate the key. A new key is issued and shown once. The old key keeps working for a grace period.
2. Restart every agent server with the new key before the grace period ends. Servers can be restarted one at a time; during the grace period, servers on the old key and servers on the new key serve the account side by side.
3. A server still on the old key stops working when the grace period ends.

The License page shows the status of the current key, and during a rotation, when the old key expires. A new rotation cannot start while a previous rotation is in its grace period.

Cancelling a rotation

If something goes wrong, cancel the rotation while the old key is still valid. The new key is invalidated at once, and the old key stays current. Servers already restarted with the new key must be restarted again with the old key.