## 6.1.1.8.5.7.1  Manually Rotate Signing Keys of Access Tokens with the SAP BTP CLI
The SAP BTP CLI enables you to manually rotate the signing keys of access tokens.
## Prerequisites
Plan for waiting time in hours between the steps of this procedure.
After activating a new key, wait for access tokens signed by the old key to expire before deleting the old key. The default lifetime of access tokens is 12 hours.
To support this delay in rotation, the service enforces a minimum 12-hour delay between rotation and the activation.
##  Note
In emergency cases or in automated test setups, you can bypass the delay in activation and deletion by using the --force option. Forcing changes can also cause service interruption for access tokens that haven't expired yet.
## Context
To rotate the signing key of access tokens, use the SAP BTP command-line interface (btp CLI). You can rotate signing keys for the global account, directory, or subaccount.
For more information, see Managing Signing Keys for Access Tokens [page 2447].
## Procedure
1. Log on to the SAP BTP CLI. For more information, see Log in [page 2416].
2. Check that there's space for a new signing key.
You can store two signing keys per subaccount.
Use the following command:
```
btp list security/token-key
```
The service lists any keys.
```
Key ID                     Enabled   Created                      Fips Compliant default-jwt-key-491aae9c42           Fri Feb 02 14:48:51 UTC 2024 yes default-jwt-key-ca81ebbb43 yes       Mon Feb 05 14:42:26 UTC 2024 yes 2 entries OK
```
Delete the inactive key if you already have two. In the previous example, delete default-jwtkey-491aae9c42 . For more information on how to delete keys, see step 6.
##  Caution
If the keyID is key-id-0 or key-id-1 , these keys are legacy signing keys. When you enable the first signing key after a legacy signing key, the legacy signing key is immediately invalid. Clients with access tokens issued within the lifetime of an access token can't use their access tokens anymore. Affected clients must reauthenticate to get a new token.
In addition, the issuer of the key changes as well. Update the configuration of systems depending on these keys, such as SAP HANA systems and cloud connector connections. For more information, see:
- Managed Certificate Collections in the SAP HANA Cloud, SAP HANA Database Security Guide
- Configure a CA Certificate in the SAP BTP Connectivity documentation
Plan for possible service interruption when you add your first signing key.
3. Add a new signing key for the access token.
Use the following command:
```
btp create security/token-key Created default signing key
```
A new signing key is generated.
4. Enable the new signing key.
Use the following command:
btp enable security/token-key --key &lt;Key\_ID&gt;
For example:
btp enable security/token-key --key default-jwt-key-ca81ebbb43 Enabled signing key 'default-jwt-key-ca81ebbb43'
New access tokens are now signed with the new signing key.
5. Wait for access tokens signed by the old key to expire.
As long as the old signing key exists, the system still accepts digital signatures signed by that key. Once you've waited out the lifetime of any access tokens signed by the old key, you can delete the old key.
6. Delete the old signing key for the access token.
```
Use the following command: btp delete security/token-key --key <Key_ID> For example: btp delete security/token-key --key default-jwt-key-491aae9c42 Do you really want to delete signing key 'default-jwt-key-491aae9c42'? [no]> Yes Deleted signing key 'default-jwt-key-491aae9c42'
```