Skip to content
Pocket ID
v2.18.0GitHub

Custom signing keys

Rotate the key Pocket ID signs tokens with, or switch to a larger RSA key, ECDSA or EdDSA.

By default, Pocket ID generates a RSA-2048 private key upon first startup, which is used to sign all tokens. You can optionally use a key with a different RSA key size (e.g. 3072 or 4096), or even a different algorithm (e.g. ECDSA with P-256, or EdDSA with Ed25519).

Pocket ID includes a command that can be used to generate a new key, which replaces the existing one and also allows rotating the private key:

Terminal window
pocket-id key-rotate

When running in a container, use a command similar to:

Terminal window
docker compose exec pocket-id /app/pocket-id key-rotate

You can specify the key algorithm using the --alg / -a flag. Supported values include:

  • RS256: RSA (PKCS#1 v1.5) with a 2048-bit key and SHA-256 (default)
  • RS384: RSA (PKCS#1 v1.5) with a 3072-bit key and SHA-384
  • RS512: RSA (PKCS#1 v1.5) with a 4096-bit key and SHA-512
  • ES256: ECDSA with curve P-256 and SHA-256
  • ES384: ECDSA with curve P-384 and SHA-384
  • ES512: ECDSA with curve P-521 and SHA-512
  • EdDSA: EdDSA with the curve specified with the --crv / -c flag; supported values: Ed25519

For example:

Terminal window
# Generates an ES256 token signing key
pocket-id key-rotate --alg ES256


# Generates an EdDSA token signing key with Ed25519
pocket-id key-rotate --alg EdDSA --crv Ed25519