Each zone has a key that the edge uses to sign browser challenge passes, challenges and Verify widget tokens. You can now rotate it. The new key is random and never shown; the configuration version (zone.challenge.key.rotate) records only when it rotated, and a revert never brings the old key back.
- Immediate, the default, for a key that may have leaked: as soon as each edge node applies the new version, passes, challenges in progress and unredeemed widget tokens signed with the old key stop validating. Visitors solve the challenge again; tokens not yet redeemed fail siteverify with
invalid-input-response. - With a grace (
grace_minutes, 1 to the zone's longest pass lifetime), for routine rotations: until then the edge keeps accepting passes and challenges in progress signed with the previous key and signs everything new with the new one.
Rotate with POST /v1/orgs/{org}/zones/{zone}/challenge/key/rotate (API), openwaf-cloud ctl challenge rotate-key example.com [--grace-minutes 60] --reason "…" or the MCP tool rotate_challenge_key. Like any configuration change it needs a reason, can be simulated first and takes expected_version.