> **Building with AI coding agents?** If you're using an AI coding agent, install the official Scalekit plugin. It gives your agent full awareness of the Scalekit API — reducing hallucinations and enabling faster, more accurate code generation.
>
> - **Claude Code**: `/plugin marketplace add scalekit-inc/claude-code-authstack` then `/plugin install <auth-type>@scalekit-auth-stack`
> - **GitHub Copilot CLI**: `copilot plugin marketplace add scalekit-inc/github-copilot-authstack` then `copilot plugin install <auth-type>@scalekit-auth-stack`
> - **Codex**: run the bash installer, restart, then open Plugin Directory and enable `<auth-type>`
> - **Skills CLI** (Windsurf, Cline, 40+ agents): `npx skills add scalekit-inc/skills --list` then `--skill <skill-name>`
>
> `<auth-type>` / `<skill-name>`: `agentkit`, `full-stack-auth`, `mcp-auth`, `modular-sso`, `modular-scim` — [Full setup guide](https://docs.scalekit.com/dev-kit/build-with-ai/)

---

# Upgrades & maintenance

## Upgrade Scalekit

New versions are available through the <a href={DISTR_URL}>Scalekit distribution portal</a>. Upgrades are performed through the portal — the Distr agent running in your cluster picks up the change and applies it automatically. Database migrations run before the new pods start.

1. ## Select the new version in the portal

   Log in to the <a href={DISTR_URL}>Scalekit distribution portal</a>. In the left sidebar, click **Deployments** and select your deployment.

   - Click **Edit deployment**
   - Under **Version**, select the new version
   - Click **Update deployment**

   The portal notifies the Distr agent in your cluster. No manual `kubectl` command is needed.

2. ## Monitor the upgrade

   The Distr agent handles chart delivery and migration sequencing. Check its logs to follow progress:

   ```bash
   kubectl logs -l app=distr-agent -n <namespace> --tail=100 -f
   ```

3. ## Verify the upgrade

   ```bash
   kubectl get pods -n <namespace>
   kubectl rollout status deployment/scalekit -n <namespace>
   ```

## Roll back an upgrade

If an upgrade causes issues, roll back using Helm:

```bash
# List revisions
helm history scalekit -n <namespace>

# Roll back to the previous revision
helm rollback scalekit -n <namespace>
```

## Renew TLS certificates

TLS certificates are managed through your cloud provider's certificate manager (for example, GCP Certificate Manager) or cert-manager. Renew certificates through your provider — the gateway picks up the updated certificate automatically without restarting Scalekit.

## Routine maintenance tasks

| Task | Frequency | Action |
|------|-----------|--------|
| Review auth logs | Daily | Admin dashboard → **Audit logs** |
| Check pod health | Daily | `kubectl get pods -n <namespace>` |
| Rotate Redis cache | As needed | Automatic — expired keys are evicted by Redis TTL |
| Back up databases | Regular | Take consistent backups of your PostgreSQL databases |
| Rotate registry token | Before expiry | Create a new token in the portal, update `artifact-registry-secret`, restart pods |
| Rotate individual secrets | Per policy | Edit the specific Kubernetes secret directly and restart pods |

---

## More Scalekit documentation

| Resource | What it contains | When to use it |
|----------|-----------------|----------------|
| [/llms.txt](/llms.txt) | Structured index with routing hints per product area | Start here — find which documentation set covers your topic before loading full content |
| [/llms-full.txt](/llms-full.txt) | Complete documentation for all Scalekit products in one file | Use when you need exhaustive context across multiple products or when the topic spans several areas |
| [sitemap-0.xml](https://docs.scalekit.com/sitemap-0.xml) | Full URL list of every documentation page | Use to discover specific page URLs you can fetch for targeted, page-level answers |