How does digirunner store and update its private key?

[Eddie-Las]

Hi all,
I’m trying to understand how digiRunner handles its own private key storage and updates. For example, when it signs JWTs — where are those keys kept, and how are they rotated?

[TPIsoftwareOSPO]

Hey 👋 thanks for asking!
Here’s the short version:

• Storage: digiRunner keeps its private keys in memory instead of saving them as files or in a database. This way, the keys aren’t left sitting around on disk, which is a big security plus.

• Rotation: digiRunner supports automatic key rotation. That means keys can be refreshed without downtime or manual restarts, so services keep running smoothly.

• Extra security: For industries with stricter requirements, digiRunner can also work with HSMs (Hardware Security Modules), where keys never leave the secure hardware.

[Eddie-Las]

Thanks,
So if I’m using digiRunner out of the box, I can assume rotation just works automatically?

[TPIsoftwareOSPO]

Yep, that’s right.
Automatic key rotation is built-in, so you don’t need to restart or manually update anything.
For most users, the default in-memory + auto-rotation setup is enough. If you’re in a highly regulated industry, HSM integration is available as an extra safeguard.