# Manage Keys
source: https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/key-management/manage-keys/index.md

## 3. Manage Keys {#3-manage-keys}

You can manage keys in the Portal using a number of available options. A drop-down menu is available next to the details of each key.

![Image](https://static.developer.mastercard.com/content/mastercard-checkout-solutions/img/key-management-functions5.png "Key Management Functions")

|   Operation    |                                                                                                                                                                                                                                                                                                                                                                                                          Description                                                                                                                                                                                                                                                                                                                                                                                                           |
|----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Renew**      | * Key renewal is available for both API Signing keys and Encryption keys. * For Signing key, it will bring up a "Renew Key" dialog - you can either enter a Keystore Password or upload an existing CSR file. * For encryption key, "Upload Certificate" functionality can be used to renew the key. Although you can renew an existing certificate, we recommend adding new keys. * Rotating keys is a recommended security practice. Note: * Before making API calls with a newly-added or renewed signing key, remember to update the OAuth header with the private key to avoid authentication issues. * After renewing an existing encryption key with a new one, Mastercard recommends you retain the old private encryption key until you see the new Key ID (KID) in the JWS header of the payload sent by Mastercard. |
| **Download**   | * Download a certificate file containing the public keys in either PEM, DER or P12 format. * Only default, auto-generated keys can be downloaded in P12 format, allowing you to download the private key along with the public key. * PEM and DER formats enable to you download the binary and text version of the key, respectively.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| **Enable Key** | * You can use this function to enable or disable encryption keys. * When an encryption key is created or uploaded for the first time, it is marked as "Enabled". * At a time, you can only create and enable one encryption key. * When an encryption key is enabled, the rest of the keys will be disabled. If you want to use a different encryption key, you must enable that key. * The enabled key should be used to perform checkout transactions.                                                                                                                                                                                                                                                                                                                                                                       |
| **Revoke**     | * Revoke a particular key. * Once you revoke a key, the key becomes inactive immediately and you can no longer use it to access the APIs. * When revoking an API Signing Key, ensure there's another active key.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |

<br />

### Key Renewal Notifications {#key-renewal-notifications}

Once you create a key, Mastercard sets a default 364 day expiry period for the key. Email notifications are sent at regular intervals to Merchants and PSPs if a key is approaching its expiration date.
Note: To avoid service interruption, renew your API Signing Key and Encryption Key prior to the expiration date.

### Key Metadata {#key-metadata}

In addition to the keys stored in the certificate file, you should keep a record of the following key metadata as these will be required to test or integrate with Mastercard.

* **SRC Client ID**: This identifier is referred to as Client ID. It is found on the Dashboard.
* **Key ID (KID)** : The key ID is provided when adding an encryption certificate. This Key ID is returned by the [POST /transaction/credentials](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#checkout) API call as `KID` in the response header. So you will use this identifier to distinguish which of your keys is required to decrypt the payload.
* **Key Alias**: The key alias used when generating the private part of the API Signing key.
* **Keystore Password**: The password used when generating the private key.