> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryrollup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Keys and revocation

> Publishable keys, key rotation, and what the SDK does when your app's access stops.

## Publishable keys

Each app in the [developer dashboard](https://www.tryrollup.com/developers) has a publishable key that starts with `rk_live_`. You pass it to `configure`, and the SDK sends it with every request to Rollup.

The key ships inside your app, so it is not a secret. A copied key is not enough to use your app's access: every device must also pass App Attest as a genuine install of your Team ID and bundle ID, and every device belongs to the app that registered it.

## What the server checks

Rollup checks your key on every request, with no caching. A change in the dashboard takes effect on the next request.

| Situation | Error |
| - | - |
| Unknown key, or a previous key past its grace period | 401 `app_key_invalid` |
| App disabled by you, or revoked or rejected by Rollup, or your developer account is not approved | 403 `app_disabled` |
| App waiting for Rollup's approval | 403 `app_pending` |
| Device registered by a different app's key | 401 `app_key_mismatch` |

## Rotating a key

Rotate a key from your app's page in the dashboard. Because installed copies of your app send the key built into them, you choose what happens to the old key:

* **Keep the old key working for 30 days** (the default). Both keys work during that time, so people can update to a version of your app with the new key. You can stop the old key early from the app's page.
* **Stop the old key now**, for example if it leaked. Installs that still send it lose access at once.

## Disabling an app

Disabling your app from the dashboard stops every install at once, whichever key it sends. Enabling it again restores access. Rollup can also revoke an app or an account; only Rollup can restore it.

## What the SDK does

The SDK checks its key with Rollup:

* when your app calls `configure`,
* at the start of every indexing run, including background runs,
* when your app becomes active, if the last check is more than a day old.

Any request that gets `app_key_invalid`, `app_disabled` or `app_key_mismatch` counts the same way.

When access stops, the SDK:

1. stops indexing and cancels its background tasks,
2. reports the state `.failed` with `accessRevoked`,
3. throws `accessRevoked` from `search`, `query` and `profile`,
4. keeps the index and models on the iPhone, locked.

While locked, the SDK checks again every time your app becomes active. If access comes back, it unlocks and indexing resumes where it stopped, without downloading or indexing again. If access stays stopped for 30 days in a row, the SDK deletes the index, the models and the device credential from the iPhone.

These never lock the SDK:

* being offline, a timeout or a server error,
* `app_pending`: the app has not been approved yet,
* a device credential the server no longer knows: the SDK registers the device again.

<Note>
  The lock on the device is part of the SDK running inside your app. Everything that needs Rollup's server (query, profile, place data and model downloads) stops on the server's side at the next request, whatever happens on the device.
</Note>

## Resetting

`reset()` deletes everything the SDK keeps on the iPhone (the index, the downloaded models and place data, queued run reports and the device credential) and the device's record on Rollup's server. Indexing starts again from scratch the next time it starts.

```swift theme={null}
try await Rollup.shared.reset()
```

If the person revokes Photos access in Settings, the SDK deletes the index the next time your app runs.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.