Key ID (kid)
A key ID, usually carried as the kid header parameter, is a string identifier that associates a JWT with a specific key in your active key set. In the JWT header, kid tells verifiers which JWK or HMAC secret mapping to use when multiple keys are valid. Good kids are stable opaque strings and are not secrets themselves because every client can read them. During rotation you publish multiple keys with distinct kids and sign with only one at a time. Missing or mismatched kids produce invalid signature failures that look like algorithm bugs to on-call engineers. Kids also appear in JWKS documents so automated verifiers can index keys efficiently under load.
Why It Matters
Operational clarity around kid prevents outages during deploys and rotations across many services. Standardize kid formats, include kid in issuer logs without logging secrets, and alert when verifiers see unknown kids — a signal of mispublish, clocked rollout bugs, or probing traffic worth investigating. Treat kid as an operational selector, not a security claim. Keep values unique per key version, include them in structured auth logs, and reject tokens whose kid is absent from your current trust set without falling back to “try every key.” When multiple keys coexist, missing or colliding kid values cause outages that look like intermittent invalid signatures. Make kid mandatory in issuer policy for any environment that can hold more than one active signing key.
Related Terms
Related Comparisons
Related Tools
Related Articles
Frequently Asked Questions
Is kid required by the JWT RFC?
No, kid is optional, but production multi-key systems should treat it as required for operational rotation. Without kid, verifiers often try keys blindly and fail noisily.
Should kid values be random?
They should be unique and stable per key version. Random opaque IDs work well; avoid embedding secrets or predictable “current” labels that encourage unsafe fallbacks.
Why did verification break after a deploy?
Often the issuer switched kid before JWKS or secrets were updated on all verifiers. Publish keys first, then start signing with the new kid.