# Recovering or rotating private keys

**URL:** https://publichappinessmovement.com/t/topic/5861
**Category:** Backend and Operations - Documentation
**Tags:** documentation, travis, private-keys, webdev
**Created:** [8 July 2025 14:44 UTC](https://publichappinessmovement.com/t/topic/5861 "2025-07-08T14:44:40Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![AndyatFocallocal](https://publichappinessmovement.com/user_avatar/publichappinessmovement.com/andyatfocallocal/32/651_2.png) [@AndyatFocallocal](https://publichappinessmovement.com/u/AndyatFocallocal)
#### Post date: [8 July 2025 14:44 UTC](https://publichappinessmovement.com/t/topic/5861/1 "2025-07-08T14:44:40Z")

</div>

If you need to recover or rotate private keys from the live sites.

Edit the relevant sections of [travis.yml](https://github.com/focallocal/fl-maps/edit/deploy-phm/.travis.yml) on the branch you want to work on to this:

```auto
env:
  global:
    - GPG_KEY_B64=$sops_gpg_key

script:
  - npm install
  - mup setup
  - mup deploy
  - echo "$GPG_KEY_B64" | base64 --decode > travis-private-key.asc
  - gpg --batch --import travis-private-key.asc
  - gpg --list-secret-keys

```

In the Travis build logs you should see the end of one of the private keys, like this:

 ![image](https://publichappinessmovement.com/uploads/default/original/2X/0/0d81e946556ddec926f770a394a7d88bb3764aaa.png)

It should match a public key pgp at [sops.yml](https://github.com/focallocal/fl-maps/blob/deploy-phm/.deployment/.sops.yaml).

# How to Recover and Save the Private Key Locally

Step 1: Decode and Save the Key (on your laptop)

If you’ve now confirmed that sops\_gpg\_key is the key you need:

```
On your laptop:

```

`echo "$sops_gpg_key" | base64 --decode > recovered-private-key.asc`

Import it:

`gpg --import recovered-private-key.asc`

Confirm it’s imported:

`gpg --list-secret-keys`

You should see:

```auto
sec rsa4096/XXXX... 2023-...
      Key fingerprint = AC7E7C66AC708F04578DD0E293C281E756221F06

```

# Rotating to new GPG keypairs.

1. Update .sops.yaml with new public key(s).

2. Re-encrypt secrets with:

`sops -r -i path/to/secrets.yaml`