Rotate the Encryption Key Without Downtime

The backend receives the DFP response in encrypted form and decrypts the payload using a secret key. If you need to replace the key, you can rotate it without affecting DFP operation.

What Key Rotation Is

Key rotation is the replacement of an old encryption key with a new one. It may be required by your internal security policy, after changing the integration setup, or if there is a risk that the old key became available to unauthorized parties.

We perform rotation without downtime: while the key is being replaced, DFP continues to work and your backend continues to decrypt responses. To do this, the backend stores both the old and new keys during rotation and tries them one after another.

How to Rotate the Key

  1. Tell us that you want to replace the encryption key.

    We will prepare a new key_new and provide it to you. Keep the old key_old for now: until the switch, DFP continues to encrypt responses with the old key.

  2. Add key_new to the list of keys on the backend.

    During rotation, your backend stores two keys:

    [
key_new,
key_old
]

    Decryption works as follows: the backend tries to decrypt the payload with the first key. If the key does not work, the backend tries the next one. When it reaches the correct key, the payload decrypts without an error.

  3. Ask us to switch encryption to the new key.

    From this point on, we encrypt all new DFP responses with key_new. The backend tries key_new first and decrypts the payload immediately.

  4. Check that new responses are decrypted.

    Make sure DFP requests work normally and the backend receives decrypted results.

  5. Wait until old responses are no longer relevant.

    Do not delete key_old immediately after the switch. The backend may still receive responses that the browser obtained before the key change but sent later. Use your timestamp validation window as a guide.

  6. Delete the old key_old.

    After this, the backend must decrypt responses only with the new key. The rotation is complete.

What to Do If Decryption Fails

A decryption error may mean that:

  • the backend uses the wrong key;

  • the new key has not yet been added to the backend;

  • we have already switched encryption to the new key, but the backend has not yet been updated;

  • payload, iv, or tag is corrupted in the response;

  • the response was modified after it was issued.

If decryption fails:

  1. Check that the backend has all keys, both the old and the new one.

  2. Make sure the backend tries keys in sequence rather than stopping after the first error.

  3. Check which key is currently used for encryption on our side.

  4. Save request_id from the DFP response.

If the cause is unclear, contact our support team and provide request_id. We will help investigate it.