How to use JWKS with Java

Paste JWKS into the browser JWKS Viewer to validate structure and kids, then verify asymmetric JWTs in Java with Nimbus JOSE+JWT or Spring Security’s jwk-set-uri. Publish public keys only, pin allowed algorithms on the verifier, rehearse dual-kid rotation before retiring keys, and keep private PEM material out of any hosted JWKS document.

Last updated August 26, 2026

Steps

  1. 1

    Open the JWKS Viewer and confirm your JWKS keys array, kids, and algorithms look correct.

  2. 2

    Export public PEM if your Java stack loads keys from PEM instead of JWK.

  3. 3

    Configure the remote JWKS URI in Spring Security OAuth2 Resource Server or a Nimbus RemoteJWKSet.

  4. 4

    Reject tokens whose alg is outside your allowlist and whose kid is unknown after refresh.

  5. 5

    Rehearse dual-kid rotation before removing old keys from JWKS.

Code Example

Java
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.jwk.source.JWKSource;
import com.nimbusds.jose.jwk.source.RemoteJWKSet;
import com.nimbusds.jose.proc.JWSVerificationKeySelector;
import com.nimbusds.jose.proc.SecurityContext;
import com.nimbusds.jwt.proc.ConfigurableJWTProcessor;
import com.nimbusds.jwt.proc.DefaultJWTProcessor;

import java.net.URL;

URL jwksUrl = new URL(System.getenv("OIDC_JWKS_URI"));
JWKSource<SecurityContext> keySource = new RemoteJWKSet<>(jwksUrl);

ConfigurableJWTProcessor<SecurityContext> processor = new DefaultJWTProcessor<>();
processor.setJWSKeySelector(
    new JWSVerificationKeySelector<>(JWSAlgorithm.RS256, keySource)
);
// processor.process(accessToken, null);
// Inspect JWKS offline with the browser JWKS Viewer during key-rotation incidents.
Open JWKS Viewer

Other languages

Node.jsPythonGoJavaRuby

Related Articles

Jwks In ProductionDebug Jwt Invalid SignatureHow To Validate Jwt Token

Frequently Asked Questions

How do I set JWKS in Spring Security?

Set spring.security.oauth2.resourceserver.jwt.jwk-set-uri to your issuer JWKS URI. Validate the document shape first in the JWKS Viewer so kids and kty match what your IdP publishes.

Why prefer Nimbus RemoteJWKSet?

It caches remote JWKS and selects keys by kid for JWS verification. Combine it with an explicit JWSAlgorithm allowlist such as RS256 or ES256.

Can I load PEM exported from the viewer in Java?

Yes for lab code paths that need X509EncodedKeySpec. Prefer JWKS/JWK for production verifiers so rotation stays automatic.

What if verification fails after rotation?

Confirm both old and new kids appear in JWKS during the dual-verify window. Paste the live document into the viewer and compare against the token header kid.