# Rotate a zone's Verify key

> Replace the key that signs a zone's Verify passes, challenges and widget tokens, immediately after a leak or with a grace for routine rotations.

Each zone has a key that the edge uses to sign [browser challenge](https://developers.openwaf.dev/waf/browser-challenge/) passes, challenges and [Verify widget](https://developers.openwaf.dev/waf/verify-widget/) tokens. You can now [rotate it](https://developers.openwaf.dev/waf/browser-challenge/#key-rotation). The new key is random and never shown; the configuration version (`zone.challenge.key.rotate`) records only when it rotated, and a revert never brings the old key back.

- **Immediate**, the default, for a key that may have leaked: as soon as each edge node applies the new version, passes, challenges in progress and unredeemed widget tokens signed with the old key stop validating. Visitors solve the challenge again; tokens not yet redeemed fail siteverify with `invalid-input-response`.
- **With a grace** (`grace_minutes`, 1 to the zone's longest pass lifetime), for routine rotations: until then the edge keeps accepting passes and challenges in progress signed with the previous key and signs everything new with the new one.

Rotate with `POST /v1/orgs/{org}/zones/{zone}/challenge/key/rotate` ([API](https://developers.openwaf.dev/api/verify/#rotate-challenge-key)), `openwaf-cloud ctl challenge rotate-key example.com [--grace-minutes 60] --reason "…"` or the MCP tool `rotate_challenge_key`. Like any configuration change it needs a reason, can be simulated first and takes `expected_version`.