> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/policy-control-and-incident-response/credential-key-rotation.md).

# Credential and signer rotation

Use this runbook for suspected compromise, scheduled rotation or loss of any operator, internal, confirmation, webhook, identity-provider or venue signer credential. Rotation must not discard exactly-once claims or turn an unknown outcome into a retry.

## Contain first

1. Open the production-authority incident procedure and disable new entry for the affected venue.
2. Stop the affected signer or local runtime before changing its private environment.
3. Preserve signer/customer databases, pending outboxes, release markers and fixed-code logs. Do not copy a live SQLite file or disclose secret values in the incident record.
4. Revoke the compromised upstream authority first when an upstream revocation facility exists.

## Rotate by credential class

| Credential                            | Rotation owner                   | Required action                                                                                                                                             |
| ------------------------------------- | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `NIGHTSHIFT_OPERATOR_SECRET`          | Security Owner                   | Replace the private launch value, restart the web control plane and revoke all stored Agent credentials/policies; old sessions must fail                    |
| `INTERNAL_EXECUTION_TOKEN`            | Security + Execution Owners      | Replace both web and signer values atomically while stopped; prove the old token gets 401 and the new token reaches only loopback health                    |
| Arcus/Hyperliquid confirmation secret | Execution Owner                  | Replace web and signer values together; all pre-rotation confirmation tickets must fail and no submitted claim may be resent                                |
| Arcus Ed25519 API key                 | Security + Execution Owners      | Revoke through the owner/master-wallet process, provision a newly scoped key outside the repository and repeat testnet qualification before any restoration |
| Hyperliquid API wallet                | Security + Execution Owners      | Revoke/disable the old API wallet at the venue, provision a new exact-account wallet and issue new eligibility/rehearsal evidence                           |
| Alert HMAC secret                     | Security + Communications Owners | Rotate receiver and sender values together while stopped; replay a non-capital test envelope and prove stale-signature/duplicate rejection                  |
| Privy app secret/token                | Identity + Security Owners       | Revoke/rotate in Privy, invalidate production evidence and repeat the complete identity rehearsal                                                           |
| Agent license/eligibility issuer key  | Security + Risk Owners           | Stop issuance, publish the new public key through controlled configuration, reissue approved records and revoke every record under the compromised key      |

Generate all replacement secrets using the approved secret manager or OS cryptographic generator. Do not generate, paste or store production secrets in this repository, a prompt, browser storage, URL, shell history or rehearsal document.

## Verification

1. Start only the affected supervised boundary with new private environment values.
2. Prove old session/token/signature/key rejection without submitting an order.
3. Run health, current schema/integrity/WAL and alert-outbox checks.
4. Reconcile every retained pending/unknown ID under the old authority. Rotation does not change its identity or permit a new request.
5. Repeat the applicable testnet rehearsal and issue a new time-bounded eligibility record. Mainnet remains disabled until separately authorized.
6. Record credential class, upstream revocation reference, rotation UTC time, affected release, approver roles and evidence digests. Record no secret, wallet, account or request body.

If upstream revocation cannot be proven, keep the signer stopped and venue entry disabled. A locally replaced environment value is not proof that leaked upstream authority is harmless.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://nytshift.gitbook.io/nytshift-docs/policy-control-and-incident-response/credential-key-rotation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.