[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-27。"],[],[],null,["# Keys overview\n\nMedia CDN uses cryptographic key pairs when signing requests.\nMedia CDN uses a *keyset* to store key pairs that are actively\nused to sign requests. You can have up to three public keys and three validation\nshared keys, for a total of six keys per keyset.\n\nYou can also remove unused keys from a keyset. Adding and removing a key\nis typically called *secret rotation*. Secret rotation lets you do the\nfollowing:\n\n- Safely add new secrets to a keyset by appending them to the keyset.\n- Generate tokens with the corresponding secret.\n- Remove old secrets after the oldest possible token expires.\n\n For example, say that you set your short-duration tokens to expire after one\n hour. Then, you'd remove the oldest secret used for the short-duration\n tokens after new requests serve users for one or more hours.\n\nBefore removing an unused secret, verify that it's not referenced or fetched to\nsign user requests on your application server. Prematurely removing a secret\nfrom a keyset prevents Media CDN from validating requests\nassociated with that secret. Affected users are served an `HTTP 403\nForbidden` response.\n\nTo optimize performance, reliability, and cost of simultaneous accesses to\nSecret Manager, your shared validation key secrets are cached for up to\none hour. Secret caching may result in continued token access after a secret is\ndeleted from Secret Manager for up to one hour.\n\nAs a best practice, rotate keys regularly.\n\nKnown limitations\n-----------------\n\nMedia CDN rejects requests that are signed with the symmetric\nsignatures used by Cloud CDN with an `HTTP 403` response.\nMedia CDN currently supports symmetric keys with requests using\nthe token format and keys referenced by Media CDN.\n\nAsymmetric keys must be generated as Ed25519 pairs, with a 512-bit (64-byte)\nprivate key, and a 256-bit (32-byte) public key. The\n[Tink library](https://github.com/google/tink) has support\nfor key generation, signing, and validating Ed25519 signatures with C++, Go,\nJava, and Objective-C.\n\nAsymmetric keys must have the following characteristics:\n\n- Be base64-encoded with a length of 44 bytes (padded) or 43 bytes\n (unpadded). Both padded and unpadded forms of base64 are accepted.\n\n- The public key must be encoded in [URL-safe base64 format](https://tools.ietf.org/html/rfc4648#section-5). The private key may be encoded in\n [standard base64 format](https://tools.ietf.org/html/rfc4648#section-4).\n\n- Have a matching private key.\n\nWhat's next?\n============\n\n- [Create keys](/media-cdn/docs/create-keys)\n- [Create a keyset](/media-cdn/docs/create-keyset)\n- [Rotate secrets](/media-cdn/docs/rotate-secrets)"]]
