# Versions & rotation

Every key keeps a history of its key material. Signing always uses the latest version by default. Rotation adds a new version without deleting the old ones.

## How versions work

The first time a key is created or imported it becomes **version 0**. Each rotation appends the next version: version 1, version 2, and so on. The version history is append-only; you cannot delete a specific version.

When a Machine User or Agent submits a signing request, the vault uses the latest version automatically. To target a specific version, pass the `version` parameter in the API call.

## View key versions

1. On the **Offchain Keys** page, find the key row and open the row actions menu (the three-dot icon).
2. Click **View Versions**.
3. The **Versions** modal lists all versions sorted newest-first. Each entry shows the version number, masked API key identifier, expiration date, and creation date. The current version is marked **Latest**.

## Rotate an HMAC key

Use rotation when the exchange issues you a new secret, or as a scheduled credential refresh.

1. On the **Offchain Keys** page, open the row actions menu for the key.
2. Click **Rotate**.
3. In the **Rotate Key** modal, paste the new **API Key** and **API Secret** from the exchange.
4. Click **Confirm**. The vault imports the new secret as the next version.

## Rotate an asymmetric key (Ed25519 / RSA)

For Ed25519 and RSA keys, the vault generates new key material rather than accepting an externally provided secret.

1. Open the row actions menu for the key and click **Rotate**.
2. Click the generate button in the modal. The vault produces new key material and returns the new public key.
3. Register the new public key with the exchange and retrieve the updated API key identifier.
4. Enter the new identifier in the modal and confirm.

The previous version remains in the version history and can be referenced by its version number.

:::tip
Schedule key rotation regularly to limit the impact of a credential compromise. Combine rotation with an expiration date on the key record to enforce rotation deadlines.
:::