Wallet secret rotation

Your Wallet Secret is the master key used to authenticate requests to the Openfort Backend infrastructure. Because this secret grants programmatic access to account creation and transaction signing, it is critical to rotate it if it is lost, leaked, or as part of a regular security audit.

When to rotate

• Compromise: If you suspect your secret has been exposed in logs, version control, or to unauthorized personnel.
• Personnel changes: When a developer with access to the secret leaves the organization.
• Compliance: To meet security standards that require periodic credential rotation (for example, every 90 days).

Rotation process

Rotation is performed via the Openfort Dashboard to ensure administrative authorization.

1. Generate New Secret: Navigate to your project settings and select Backend Wallets. Click Generate New Secret.
2. Verify Identity: Complete the required Two-Factor Authentication (2FA) challenge.
3. Confirm Deletion: To prevent accidental lockouts, you must manually confirm the deletion of the existing secret (for example, by typing delete secret).
4. Update Environment: Immediately copy the new secret and update your server's environment variables.

Lost access

If you have lost your secret and don't have a backup, the rotation process acts as a recovery mechanism. Generating a new secret restores your ability to manage your existing backend wallets without losing access to on-chain assets.