How to use JWKS with Node.js

Use the JWKS Viewer to inspect issuer key sets, strip accidental private fields, and convert public PEMs into JWKS JSON. Then verify asymmetric JWTs in Node.js with jose createRemoteJWKSet (or a local JWKS file for labs). Keep private keys out of JWKS, pin algorithms on every verify call, and configure the JWKS URI out-of-band — never from a client-supplied jku header.

Last updated August 26, 2026

Steps

  1. 1

    Open the JWKS Viewer and paste your issuer JWKS JSON (or click Load sample) to inspect kid, kty, and alg.

  2. 2

    Confirm there is no private material; use Copy public-only if needed, then export a public PEM if your Node library prefers PEM over JWK.

  3. 3

    In Node.js, prefer createRemoteJWKSet with your configured OIDC JWKS URI, or load JWKS JSON you built locally for tests.

  4. 4

    Verify tokens with an explicit algorithms allowlist (RS256 or ES256) and match kid to the correct public key.

  5. 5

    During rotation, keep both kids in JWKS until outstanding tokens expire, then remove the retired key.

Code Example

Node.js
const { createRemoteJWKSet, jwtVerify } = require('jose');

const JWKS = createRemoteJWKSet(new URL(process.env.OIDC_JWKS_URI));

async function verifyAccessToken(token) {
  const { payload } = await jwtVerify(token, JWKS, {
    algorithms: ['RS256'],
    issuer: process.env.OIDC_ISSUER,
    audience: process.env.API_AUDIENCE,
  });
  return payload;
}
Open JWKS Viewer

Other languages

Node.jsPythonGoJavaRuby

Related Articles

Jwks In ProductionDebug Jwt Invalid SignatureHow To Validate Jwt Token

Frequently Asked Questions

Which Node library should I use with JWKS?

jose is a strong default for createRemoteJWKSet + jwtVerify. jsonwebtoken works too if you resolve keys by kid yourself from a JWKS document inspected in the viewer.

Should Node services trust the jku header?

No. Configure OIDC_JWKS_URI (or equivalent) in environment config. Ignore inbound jku on tokens to avoid fetching attacker-controlled keys.

How do I test JWKS locally in Node?

Build or inspect a document in the JWKS Viewer, save jwks.json, and load it in tests. Prefer the remote JWKS URI path for staging and production.

Can I export PEM for Node crypto?

Yes. Export public PEM from View mode, or use createPublicKey({ key: jwk, format: "jwk" }) when you already have a public JWK from the viewer.