# URL signing keys

Learn how Supabase Storage signs URLs and how to rotate your signing keys.

Rotate and revoke the keys that sign Storage URLs. Signed URLs give people time-limited access to private objects, as created with `createSignedUrl` for [downloads](https://supabase.com/docs/guides/storage/serving/downloads#signing-urls) and `createSignedUploadUrl` for [uploads](https://supabase.com/docs/guides/storage/uploads/standard-uploads#presigned-uploads).

Storage signs URLs with a dedicated internal key, separate from your project's Auth JWT signing key. Each project has its own key.

Because of this, signed URLs are not affected by:

- Rotating or revoking the Auth [JWT signing keys](https://supabase.com/docs/guides/auth/signing-keys) or legacy secret
- Disabling legacy keys in the Supabase Dashboard
- Switching from a shared secret (HS256) to an asymmetric (ES256) signing key

Signed URLs remain valid until their expiry time regardless of any Auth key changes.

## Revoking signed URLs

To revoke all signed URLs, go to the [URL Signing Keys](https://supabase.com/dashboard/project/_/storage/signing-keys) page in the Supabase Dashboard. Rotate the signing key, and then revoke the previous key.

After you revoke the active signing key, existing signed URLs return an `InvalidJWT` error, and new signed URLs use the updated key.

Note: After revoking a key, previously accessed signed URLs can still be served from the CDN cache. If you need to ensure that all previously cached signed URLs are invalidated, you must [purge the CDN cache](https://supabase.com/docs/guides/storage/cdn/purge-cdn-cache) for those objects or buckets.

## Lifetime of a URL signing key

All newly created keys start off as standby keys. A standby key can be rotated to active state, which will make the existing active key become a standby key. There can only ever be exactly one active key and one standby key.

All signed URLs are created using the active key, but URLs signed by either the active or the standby key are considered valid.

When a standby key is revoked, URLs previously signed with that key will no longer be accepted.

At any point, you can move a key from the revoked state back to being a standby key, and then rotate it to active state. This gives you the confidence to revert to an older key if you identify problems with the rotation, such as forgetting to update a component of your application that is relying on a specific key.

The following table lists each key action, the signatures accepted during that action, and its effect.

| Action                       | Accepted signatures                                    | Description                                                                                                                                                                                                                        |
| ---------------------------- | ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Create standby key           | Active key only, new key has not created any JWTs yet. | When you initially create a key, after choosing the signing algorithm, it starts out in the standby state.                                                                                                                         |
| Rotate key                   | Both keys in the rotation.                             | Rotation only changes the key used by Supabase Storage to create new signed URLs, but the trust relationship with both keys remains.                                                                                               |
| Revoke key                   | Only from the current key.                             | Once all regularly valid signed URLs have expired (or sooner), revoke the previously used key to revoke trust in it.                                                                                                               |
| Move to standby from revoked | Current and previously revoked key.                    | If you've made a mistake or need more time to adjust your application, you can move a revoked key to standby. Follow up with a rotation to ensure Storage starts using the originally revoked key again to create new signed URLs. |