Based on the available documentation, there isn't a specific architecture pattern documented for rotating the OPAL master token without invalidating connections (1) (2) . The master token (

OPAL_AUTH_MASTER_TOKEN

) is used to generate client JWT tokens for authentication (2) . When you update the master token on the server, existing client JWTs that were generated with the old master token would become invalid, which explains why connections break . To rotate the master token, you would need to: 1. Generate new client JWT tokens using the new master token via the CLI or REST API (3) (2) 2. Update the

OPAL_CLIENT_TOKEN

environment variable on all clients with the newly generated tokens (3) 3. Restart the clients to use the new tokens You can generate a new master token using:

opal-server generate-secret

(2) And obtain new client tokens with:

opal-client obtain-token $OPAL_AUTH_MASTER_TOKEN --server-url=$YOUR_SERVERS_ADDRESS

Or via the REST API:

curl --request POST '<https://opal.yourdomain.com/token>' \
--header 'Authorization: Bearer MY_MASTER_TOKEN' \
--header 'Content-Type: application/json' \
--data-raw '{
 "type": "client"
}'

(3) However, the documentation doesn't provide a zero-downtime rotation pattern or a way to maintain connections during the rotation process.

To learn more, see the sources I considered: [[1] OPAL Configuration Guide | OPAL](https://docs.opal.ac/getting-started/configuration) [[2] Running the Server and Client in Secure Mode](https://docs.opal.ac/getting-started/running-opal/as-python-package/secure-mode-setup) [[3] Obtain the JWT token](https://docs.opal.ac/getting-started/running-opal/run-opal-client/obtain-jwt-token)