Orders and identity
Identity secret rotation
How identity secrets rotate automatically on plugin platforms, how to rotate a Generic store's secret, and what to do after a leak.
Each store has an identity secret that signs customer tokens.
| Platform | Held by | Rotation |
|---|---|---|
| Shopify | ShopAssist only | Automatic every 180 days |
| Magento 2, WooCommerce, PrestaShop | ShopAssist and the plugin (encrypted) | Automatic every 180 days; the new secret is pushed to the plugin |
| Generic | ShopAssist and your server | Manual; a reminder after 365 days |
Rotate a Generic secret
- Settings → Connection → Signed-in customers → Rotate identity secret.
- Copy the new secret and key id (shown once) to your server and deploy.
- The previous secret keeps working for 24 hours, so tokens minted during the deploy still verify.
After a leak
Choose Rotate and revoke the previous secret now. Tokens signed with the old secret fail immediately; signed-in customers are treated as guests until your server uses the new secret. On plugin platforms, use Reconnect, which issues fresh secrets.
ShopAssist alerts you when one chat session presents tokens for several different customers, a sign of a leaked secret.
Last updated on