{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-guides/developer/auth-and-security/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["sub-header","admonition"]},"type":"markdown"},"seo":{"title":"Security expiry notifications","siteUrl":"https://docs.wise.com","projectTitle":"Wise Platform","description":"Rotate JSON Web Signature (JWS) signing keys in Developer Hub (DevHub) by uploading a new public key, switching your signer to the new private key, and then revoking the old key safely."},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"security-expiry-notifications","__idx":0},"children":["Security expiry notifications"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"span","attributes":{"class":"sub-header"},"children":[" Expiry notifications for mTLS certificates, JOSE JWS and JWE keys "]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Wise sends security credentials expiry email reminders for:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["mTLS client certificates"]}," used to authenticate to Wise APIs"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["JOSE JWS & JWE keys"]}," used for request signing and encrypting (based on the expiry date you provide when uploading the key)"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This helps remind you to rotate certificates/keys before they expire and avoid interruptions to your integration."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"who-receives-these-emails","__idx":1},"children":["Who receives these emails"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Notifications are sent to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["technical contact email address"]}," we have on file for your organisation."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To ensure you receive expiry notifications we recommend you:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Keep your ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["technical contact details up to date"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["shared mailbox"]},"  rather than an individual address"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Ensure your email security tools allow receipt from Wise email domains"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"when-we-send-notifications","__idx":2},"children":["When we send notifications"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["We send reminders ahead of the expiry date so you can rotate in time."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Reminder schedule:"]}," we currently send notifications ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["28, 14, 7, 3, 1, and 0 days"]}," before the expiry date."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Notifications continue on the schedule until the expiring credential is no longer active (for example, revoked / replaced)."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-you-need-to-do","__idx":3},"children":["What you need to do"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you receive an expiry notice, rotate the relevant credential before the expiry date:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/developer/auth-and-security/mtls"},"children":["mTLS setup & certificate rotation"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/developer/auth-and-security/jose/jose-jws-key-rotation"},"children":["JWS setup & key rotation"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/developer/auth-and-security/jose/jose-jwe-key-rotation"},"children":["JWE setup & key rotation"]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If an mTLS certificate or JOSE key expires and is still being used, your integration may fail (for example, authentication or signature/encryption validation may no longer succeed). To avoid disruption, rotate credentials as soon as you receive an expiry reminder."]}]},"headings":[{"value":"Security expiry notifications","id":"security-expiry-notifications","depth":1},{"value":"Who receives these emails","id":"who-receives-these-emails","depth":2},{"value":"When we send notifications","id":"when-we-send-notifications","depth":2},{"value":"What you need to do","id":"what-you-need-to-do","depth":2}],"frontmatter":{"seo":{"description":"Rotate JSON Web Signature (JWS) signing keys in Developer Hub (DevHub) by uploading a new public key, switching your signer to the new private key, and then revoking the old key safely.","title":"Security expiry notifications"}},"lastModified":"2026-07-27T12:55:55.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/developer/auth-and-security/expiry-notifications","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}