Both keys are usable, and only one key is needed at a time. Thanks to these 2 keys, you can change a key without down time of your application. For example, if you want to replace your primary key, the procedure is :

• Configure your application to use the secondary key;
• Deploy it to your customers;
• Regenerate the primary key;
• (optional) reconfigure your application to use the new primary key