The Dual-Key Verification Pattern
1. **Stage 1**: Add the new key (`KEY_V2`) to your server's key dictionary alongside the current key (`KEY_V1`).
2. **Stage 2**: Start signing all newly minted tokens with `KEY_V2`, setting `kid: "v2"` in the header.
3. **Stage 3**: Verification looks up the key matching the token's `kid`. Existing `v1` tokens validate against `KEY_V1`, while new `v2` tokens validate against `KEY_V2`.
4. **Stage 4**: Once `v1` token lifespans expire (e.g. 1 hour later), safely decommission `KEY_V1`.
Frequently Asked Questions
Does this work for both HMAC and RSA keys?
Yes! The "kid" pattern is universal and works equally well for symmetric HMAC secrets and asymmetric RSA/ECDSA key pairs.