JWKS URI
A JWKS URI is an HTTPS URL that returns a JSON Web Key Set documenting public keys used to verify JWTs issued by an authorization server. In OpenID Connect, discovery documents expose jwks_uri so relying parties can retrieve issuer keys dynamically without embedding certificates in every service. Verifiers should fetch over TLS, cache keys with sensible TTLs, select the correct key via kid, and pin the issuer host rather than trusting per-token jku values from clients. Private signing keys never appear in JWKS responses. Rotating keys means publishing a new JWK alongside the old one until outstanding tokens expire, then removing the retired key from the document carefully.
Why It Matters
JWKS URIs are the operational backbone of asymmetric JWT ecosystems at scale. Misconfigured caching can break authentication during rotation windows; over-trusting remote URLs can enable forgery. Treat JWKS hosting like critical auth infrastructure with HTTPS only, monitored availability, change alerts, and rehearsed rotation playbooks shared by platform and security teams. Publish JWKS over HTTPS with caching headers that still allow timely rotation, monitor 5xx and stale-kid spikes, and rehearse dual-key windows in staging before production cutovers. Document the exact URI in issuer metadata your clients consume.
Code Example
// Configure issuer JWKS URI out-of-band; do not trust token jku
const JWKS_URI = process.env.OIDC_JWKS_URI;Related Terms
Related Comparisons
Related Tools
Related Articles
Frequently Asked Questions
Should JWKS documents be public?
Yes — they must contain public keys only, never private material. Still serve them over HTTPS and monitor for unexpected key changes, downtime, or tampering signals.
How often should clients refresh JWKS?
Follow Cache-Control from the JWKS response and refresh immediately on unknown kid or signature failure suspected to be rotation. Do not hammer the endpoint on every request.
Can HS256 secrets appear in JWKS?
No. JWKS publishes public keys for asymmetric algorithms. HMAC secrets must stay in a secrets manager and never appear in public JWKS documents.