Key rotation shouldn't mean taking your services offline for a database migration. With wauth's rotate_key(), every secret in your vault is re-encrypted atomically under the new key in milliseconds.
Here is the exact production implementation for Automatic Key Rotation & Re-Encryption:
from wauth import WAuth
auth = WAuth(db_path="production_vault.db", custom_key="old-master-passphrase-2025")
auth.set("DB_PASSWORD", "super-secret-pass")
auth.set("API_KEY", "stripe_token_xyz")
# Atomic key rotation across all stored secrets
rotation_results = auth.rotate_key("new-master-passphrase-2026")
print("Rotation results:", rotation_results)
# {'DB_PASSWORD': True, 'API_KEY': True}
# Secrets are now secured under the new key!
print("Decrypted with new key:", auth.get("DB_PASSWORD"))
Why this changes developer velocity:
-
Atomic Batch Re-Encryption:
auth.rotate_key('new-key')re-encrypts all secrets in a single transaction. - Old Key Invalidation: Once rotated, previous keys are completely incapable of decrypting records.
- Granular Rotation Reporting: Returns a status dictionary detailing the outcome of each individual secret.
Zero Pain:
- Key rotation requiring scheduled maintenance windows and manual database exports
- Partial rotation failures leaving databases half-encrypted with old keys and half with new keys
- Application downtime when compliance audits mandate immediate key revocation
Explore the verified open-source repository on GitHub or install it via:
pip install wauth
Author: William Steve Rodríguez Villamizar (Wisrovi)
Top comments (0)