Symptoms
- A previously working key fails across every endpoint.
- A different active key on the same account still works.
Likely causes
- The key was disabled, expired, revoked, or its owning account was disabled.
- A deployment retained an old secret after rotation.
How to diagnose
- Check key status and expiry in the TokenReply console.
- Confirm the active deployment secret version and update time.
- Test with a new key without deleting the old audit record first.
Fixes
- Enable the key only when that is intentional and safe, otherwise create a replacement.
- Update the deployment secret and remove stale replicas or scheduled jobs.
- Keep rotation overlap short and revoke the superseded key.
How to verify
The intended active key works and the disabled or expired key still fails.