How to use JWKS with Go

Use the JWKS Viewer to inspect public key sets and catch private-material mistakes, then verify JWTs in Go with a remote JWKS client such as keyfunc and golang-jwt. Keep signing keys private, publish only public JWKs, pin valid methods with WithValidMethods, and select keys by kid throughout dual-key rotation windows.

Last updated August 26, 2026

Steps

  1. 1

    Inspect your JWKS document in the JWKS Viewer and note kid values used on production tokens.

  2. 2

    Configure your Go service with the issuer JWKS URI from environment config.

  3. 3

    Verify tokens with RS256 or ES256 only — reject unexpected algorithms via WithValidMethods.

  4. 4

    Cache JWKS and refresh when an unknown kid appears after rotation.

  5. 5

    Never embed private PEM material in JWKS JSON served to clients.

Code Example

Go
import (
    "os"

    "github.com/MicahParks/keyfunc/v2"
    "github.com/golang-jwt/jwt/v5"
)

func verifyAccessToken(accessToken string) (*jwt.Token, error) {
    jwks, err := keyfunc.Get(os.Getenv("OIDC_JWKS_URI"), keyfunc.Options{})
    if err != nil {
        return nil, err
    }
    return jwt.Parse(accessToken, jwks.Keyfunc, jwt.WithValidMethods([]string{"RS256"}))
}
Open JWKS Viewer

Other languages

Node.jsPythonGoJavaRuby

Related Articles

Jwks In ProductionDebug Jwt Invalid SignatureHow To Validate Jwt Token

Frequently Asked Questions

Why use keyfunc with golang-jwt?

keyfunc fetches and caches remote JWKS and supplies a Keyfunc that selects by kid. Pair it with WithValidMethods so unexpected algorithms fail closed.

How do I debug invalid signature in Go?

Decode the token header kid, paste the issuer JWKS into the JWKS Viewer, and confirm the matching public key exists and has no private fields. Then re-check algorithm allowlists.

Should Go services accept jku?

No for first-party APIs. Bind verification to a configured JWKS URI. Treat inbound jku as untrusted input.

Can I unit-test with a static JWKS file?

Yes. Build a public-only document in the viewer, commit a lab fixture (never private keys), and point tests at that file while production uses the remote URI.