Sign refresh tokens with the join token's API key (#5088)

Refresh tokens were signed with the first configured key pair, which is
an arbitrary map entry when several keys are configured. Keep the join
token's API key on the participant and sign with it when its secret is
still configured, falling back to the first key pair otherwise.

pkg/rtc/participant.go

@@ -197,6 +197,7 @@ type ParticipantParams struct {
 	SimTracks                         map[uint32]interceptor.SimulcastTrackInfo
 	Grants                            *auth.ClaimGrants
 	TokenExpiresAt                    time.Time
+	APIKey                            string
 	InitialVersion                    uint32
 	ClientConf                        *livekit.ClientConfiguration
 	ClientInfo                        ClientInfo
@@ -859,6 +860,10 @@ func (p *ParticipantImpl) TokenExpiresAt() time.Time {
 	return p.params.TokenExpiresAt
 }
 
+func (p *ParticipantImpl) APIKey() string {
+	return p.params.APIKey
+}
+
 func (p *ParticipantImpl) SetPermission(permission *livekit.ParticipantPermission) bool {
 	if permission == nil {
 		return false

pkg/rtc/types/interfaces.go

@@ -525,6 +525,7 @@ type LocalParticipant interface {
 	// permissions
 	ClaimGrants() *auth.ClaimGrants
 	TokenExpiresAt() time.Time
+	APIKey() string
 	SetPermission(permission *livekit.ParticipantPermission) bool
 	CanPublish() bool
 	CanPublishSource(source livekit.TrackSource) bool

pkg/rtc/types/typesfakes/fake_local_participant.go

@@ -23,6 +23,16 @@ import (
 )
 
 type FakeLocalParticipant struct {
+	APIKeyStub        func() string
+	aPIKeyMutex       sync.RWMutex
+	aPIKeyArgsForCall []struct {
+	}
+	aPIKeyReturns struct {
+		result1 string
+	}
+	aPIKeyReturnsOnCall map[int]struct {
+		result1 string
+	}
 	ActiveAtStub        func() time.Time
 	activeAtMutex       sync.RWMutex
 	activeAtArgsForCall []struct {
@@ -1655,6 +1665,58 @@ type FakeLocalParticipant struct {
 	invocationsMutex sync.RWMutex
 }
 
+func (fake *FakeLocalParticipant) APIKey() string {
+	fake.aPIKeyMutex.Lock()
+	ret, specificReturn := fake.aPIKeyReturnsOnCall[len(fake.aPIKeyArgsForCall)]
+	fake.aPIKeyArgsForCall = append(fake.aPIKeyArgsForCall, struct {
+	}{})
+	stub := fake.APIKeyStub
+	fakeReturns := fake.aPIKeyReturns
+	fake.recordInvocation("APIKey", []interface{}{})
+	fake.aPIKeyMutex.Unlock()
+	if stub != nil {
+		return stub()
+	}
+	if specificReturn {
+		return ret.result1
+	}
+	return fakeReturns.result1
+}
+
+func (fake *FakeLocalParticipant) APIKeyCallCount() int {
+	fake.aPIKeyMutex.RLock()
+	defer fake.aPIKeyMutex.RUnlock()
+	return len(fake.aPIKeyArgsForCall)
+}
+
+func (fake *FakeLocalParticipant) APIKeyCalls(stub func() string) {
+	fake.aPIKeyMutex.Lock()
+	defer fake.aPIKeyMutex.Unlock()
+	fake.APIKeyStub = stub
+}
+
+func (fake *FakeLocalParticipant) APIKeyReturns(result1 string) {
+	fake.aPIKeyMutex.Lock()
+	defer fake.aPIKeyMutex.Unlock()
+	fake.APIKeyStub = nil
+	fake.aPIKeyReturns = struct {
+		result1 string
+	}{result1}
+}
+
+func (fake *FakeLocalParticipant) APIKeyReturnsOnCall(i int, result1 string) {
+	fake.aPIKeyMutex.Lock()
+	defer fake.aPIKeyMutex.Unlock()
+	fake.APIKeyStub = nil
+	if fake.aPIKeyReturnsOnCall == nil {
+		fake.aPIKeyReturnsOnCall = make(map[int]struct {
+			result1 string
+		})
+	}
+	fake.aPIKeyReturnsOnCall[i] = struct {
+		result1 string
+	}{result1}
+}
 func (fake *FakeLocalParticipant) ActiveAt() time.Time {
 	fake.activeAtMutex.Lock()
 	ret, specificReturn := fake.activeAtReturnsOnCall[len(fake.activeAtArgsForCall)]

pkg/service/roommanager.go

@@ -506,6 +506,7 @@ func (r *RoomManager) StartSession(
 		SubscribeEnabledCodecs:   enabledCodecs,
 		Grants:                   pi.Grants,
 		TokenExpiresAt:           pi.TokenExpiresAt,
+		APIKey:                   pi.APIKey,
 		Reconnect:                pi.Reconnect,
 		Logger:                   pLogger,
 		Reporter:                 roomobs.NewNoopParticipantSessionReporter(),
@@ -1156,7 +1157,7 @@ func (r *RoomManager) iceServersForParticipant(apiKey string, participant types.
 }
 
 func (r *RoomManager) refreshToken(participant types.LocalParticipant) error {
-	key, secret, err := r.getFirstKeyPair()
+	key, secret, err := r.getSigningKeyPair(participant.APIKey())
 	if err != nil {
 		return err
 	}
@@ -1202,6 +1203,14 @@ func (r *RoomManager) getIceConfig(roomName livekit.RoomName, participant types.
 	return r.iceConfigCache.Get(iceConfigCacheKey{roomName, participant.Identity()})
 }
 
+// getSigningKeyPair prefers the key that signed the join token so refreshed tokens stay valid when other keys are rotated.
+func (r *RoomManager) getSigningKeyPair(apiKey string) (string, string, error) {
+	if secret := r.config.Keys[apiKey]; apiKey != "" && secret != "" {
+		return apiKey, secret, nil
+	}
+	return r.getFirstKeyPair()
+}
+
 func (r *RoomManager) getFirstKeyPair() (string, string, error) {
 	for key, secret := range r.config.Keys {
 		return key, secret, nil

pkg/service/roommanager_token_test.go

@@ -0,0 +1,58 @@
+// Copyright 2026 LiveKit, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package service
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/livekit/protocol/auth"
+
+	"github.com/livekit/livekit-server/pkg/config"
+	"github.com/livekit/livekit-server/pkg/rtc/types/typesfakes"
+)
+
+func TestRefreshTokenSigningKey(t *testing.T) {
+	keys := map[string]string{
+		"key1": "secret1-secret1-secret1-secret1-secret1",
+		"key2": "secret2-secret2-secret2-secret2-secret2",
+	}
+	r := &RoomManager{config: &config.Config{Keys: keys}}
+
+	refresh := func(t *testing.T, apiKey string) *auth.APIKeyTokenVerifier {
+		p := &typesfakes.FakeLocalParticipant{}
+		p.APIKeyReturns(apiKey)
+		p.ClaimGrantsReturns(&auth.ClaimGrants{Video: &auth.VideoGrant{RoomJoin: true}})
+		require.NoError(t, r.refreshToken(p))
+		require.Equal(t, 1, p.SendRefreshTokenCallCount())
+
+		v, err := auth.ParseAPIToken(p.SendRefreshTokenArgsForCall(0))
+		require.NoError(t, err)
+		_, _, err = v.Verify(keys[v.APIKey()])
+		require.NoError(t, err)
+		return v
+	}
+
+	t.Run("join key", func(t *testing.T) {
+		for apiKey := range keys {
+			require.Equal(t, apiKey, refresh(t, apiKey).APIKey())
+		}
+	})
+
+	t.Run("unknown key falls back", func(t *testing.T) {
+		require.Contains(t, keys, refresh(t, "unknown").APIKey())
+	})
+}