How to rotate AUTH_SECRET without signing everyone out

Updated October 2026

Changing AUTH_SECRET the naive way, swap the value and redeploy, signs out every logged-in user at once, because every session cookie was encrypted with the old secret. Auth.js v5 and better-auth both have a real fix for this. NextAuth v4 does not.

Here's the exact process for each.

The manual steps, Auth.js v5

1. Add the new secret to the front of the list, keep the old one after it: secret: [process.env.AUTH_SECRET, process.env.AUTH_SECRET_OLD].filter(Boolean). Auth.js's own reference, checked December 22, 2026, confirms the behavior: "the first secret that successfully decrypts the JWT will be used... The newer secret should be added to the start of the array."
2. Deploy with both secrets present. New sessions encrypt with the first one. Old sessions keep decrypting against the second one until they expire on their own.
3. Once enough time has passed that no live session still depends on the old secret, drop AUTH_SECRET_OLD and redeploy again.

The manual steps, better-auth

1. Set the env var with both secrets, newest first: BETTER_AUTH_SECRETS="2:new-secret,1:old-secret", or pass the equivalent secrets option in code. better-auth's own docs, checked December 22, 2026, state that only the first entry encrypts, "the others only decrypt."
2. Deploy. better-auth's blog post on the feature says cookie-backed session data "will automatically use the current key and remain compatible with previous keys where supported."
3. Watch for anything mid-flight during the cutover. The "where supported" qualifier in better-auth's own wording covers some plugins, not all of them, so an OAuth or SAML sign-in that's actively in progress at the exact moment of a redeploy may need to restart rather than resume cleanly.
4. Drop the old secret once you're confident no session still needs it.

What breaks if you miss a place

Skip the array or the multi-secret env var and go straight to replacing the value: every session encrypted under the old secret stops decrypting the instant the new secret is the only one left. Every signed-in user gets logged out at the same moment, which on most apps looks exactly like an outage until someone checks the auth logs and realizes it was a secret rotation, not a crash.

How to check the old secret is actually retired

There's no API call to ask a session cookie which secret it was encrypted with. The practical check is time: leave the old secret in the array or env var for at least as long as your session's max age, so every session issued before the rotation has had the chance to expire naturally, then remove it and redeploy once more.

NextAuth v4 cannot do this

NextAuth v4's own docs list secret as a single string, nothing else. There's no array, no rotation support. If you're still on v4, the only clean path is accepting that a secret change logs everyone out, or upgrading to Auth.js v5 first.

Or let Key Robot do it

Key Robot does this for you today. There is no service and nothing to paste. The robot makes a new random value, puts it in AUTH_SECRET, and moves the old value to AUTH_SECRET_PREVIOUS. Your app passes both to Auth.js as secret: [new, old], so nobody is signed out. At the next change, the oldest value drops out.

In our live test on October 26, 2026, one change took 12 seconds on a Cloudflare Workers app, and the undo worked. Do not use it with NextAuth v4, which takes one value only.