An edge record tells central that a running edge deployment exists and which public key proves that it is the real one. Use this screen to register that record, rotate its key and switch the DPoP nonce requirement for the calls the edge proxies. For what edge itself does, see Edge overview.
Before you start
The Edges item sits under GLOBAL in the sidebar: edges are not tenant-scoped. You need the edges:read permission to see the screen. Creating an edge, rotating or deleting a key, deleting an edge and switching the nonce requirement need edges:manage; without it the buttons and the checkbox are hidden or read-only.
What an edge record is
central stores four things per edge:
| Field | Meaning |
|---|---|
| Edge ID | The name of the deployment, for example edge-default. Set once, never edited. |
| Public key | The RSA public key (JWK) that matches the private key the edge holds. central never stores the private key. |
| Old public key | Present only while a key rotation is in progress. |
| Require DPoP nonce | Whether this edge demands a DPoP nonce on every proxied call. New edges start with it on. |
An edge instance identifies itself to central with a signed token. It signs a JWT with RS256 using its private key, puts its key-id in the kid header and its id in an edge_id header, and sends the token to central. central finds the edge record by edge_id and verifies the signature against the stored public key, or against the old one during a rotation. The token lives 10 minutes and the edge renews it every 9. With that token the edge pulls its configuration from central (resources, endpoints, permissions, roles, clients, presets, keys and the DPoP policy) every configuration-cache-refresh-interval.
auth reads the same records. When edge calls auth on behalf of a signed-in user, it sends a short-lived assertion signed with the same key, and auth checks it against the edge’s public key and against the tenants linked to that edge. An assertion from an edge that is registered but not the one behind the token’s tenant is refused.
How the record maps to edge configuration
The console and the edge configuration file must agree on three values. See Edge configuration for the file itself.
| Edge configuration key | Where the value comes from |
|---|---|
id | Edge ID in this screen. |
key-id | Key ID, shown once when you create or rotate. It is the UTC creation time, in the form 2026-10-14_07-29-17. |
private-key | Private Key, shown once at the same moment. central generates a 2048-bit RSA key pair and keeps only the public half. |
Creating a record deploys nothing. The CLI and the Helm chart generate the edge configuration. On a fresh installation central also seeds the edges named in its bootstrap configuration (edge-default in a CLI installation) and links the default tenant to the first one. Register an edge yourself when you run an additional one.
The list
Each row shows the edge ID, a pencil (edit) and a cross (delete). A Key Rotation badge appears next to the ID while the edge still has an old key. Click the row to expand it.
Linked tenants
Linked Tenants lists the tenants whose Edge field points at this edge. You cannot change the links here. Set them in the tenant form, see Tenant. With no linked tenants the row says “No tenants assigned to this edge”.
DPoP nonce
The DPoP Nonce section holds one checkbox, Required on every proxied call, with an i button that explains it. It controls RFC 9449 section 9 on the calls this edge proxies to your API.
| State | What the edge does |
|---|---|
| On | Every DPoP proof must carry a nonce the edge issued. A call without one gets use_dpop_nonce and a fresh nonce in the DPoP-Nonce header, and the client retries with it. The cost is one extra round trip per client per nonce lifetime, not per request. |
| Off | The nonce claim is not read and no nonce is issued. There is no “prefer” mode. |
The change reaches the edge on its next configuration sync. Before you turn it on, check that every client that calls through this edge with DPoP implements the use_dpop_nonce retry; otherwise its proxied calls start to fail. Turning it off breaks nothing.
The setting covers this edge and the calls it proxies. The /token and /userinfo endpoints of auth follow the tenant’s Require DPoP nonce setting in Challenges & Security. For the background, see Sender-constrained tokens.
Create an edge
- Click + Create Edge. If the list is empty, the same button sits in the empty state.
- Type the part of the ID after the fixed
edge-prefix. Use lowercase letters, numbers and hyphens, for exampleus-east-1. The form shows an error if the full ID is invalid or already exists. - Click Create Edge.
The console then shows the Edge Key Generated banner with the Edge ID, Key ID and Private Key. The private key is not stored and cannot be shown again. Click Copy Private Key, put the three values into the edge configuration, and click I’ve Saved It.
Rotate a key
Rotate the key when it may have leaked or on your own schedule. Both keys work during the transition, so no edge instance has to stop.
- Click the pencil on the edge row.
- Click Rotate Key and confirm. The console shows an Edge Key Rotated banner with the new Key ID and Private Key. Save them.
- Replace
key-idandprivate-keyin the configuration of every edge instance and restart them. - When no instance uses the old key any more, open the edge again and click Delete old key. After that only the new key works.
While an old key exists, Rotate Key is replaced by Delete old key. You cannot start a second rotation before you finish the first.
Delete an edge
Click the cross on the row and confirm. The record and its keys are removed, and every tenant that pointed at it is left without an edge. An edge instance still running with that id can no longer authenticate to central. Link the tenants to another edge before you delete.
Next steps
- Edge configuration — the
id,key-idandprivate-keykeys and the rest of the file - Edge overview — what
edgedoes in front of your API - Sender-constrained tokens — why a DPoP nonce exists