keys rotate

Rotate encrypted event envelopes to a new key version. The command only prints a plan by default.

1mellon keys rotate --to v2

Before apply, configure the Worker with all old and new keys:

123ENCRYPTION_KEYS={"v1":"derived:BETTER_AUTH_SECRET","v2":"<new-base64-key>"}
ENCRYPTION_KEY_VERSION=v2
MELLON_OPERATOR_TOKEN=<random-operator-token>

Then run the rotation with the same operator token in the CLI environment:

12MELLON_OPERATOR_TOKEN=<random-operator-token> \
  mellon keys rotate --to v2 --api-url https://secrets.example.com --apply

The operation uses verified, retry-safe batches. Keep v1 configured until the command completes, application reads pass, and a restore drill succeeds. The command does not remove old keys.

Use derived:BETTER_AUTH_SECRET for v1 when Mellon previously used its self-hosting default. If the instance previously used ENCRYPTION_KEY, provide that original base64 key as v1 instead.

Options

Option	Description
`--to <version>`	Active target key version
`--batch-size <count>`	Events per request, from 1 to 500 (default: 100)
`--api-url <url>`	Mellon instance URL
`--apply`	Apply the reviewed rotation