How to use JWKS with Python

Inspect or build JWKS documents with the browser JWKS Viewer, then verify asymmetric JWTs in Python using PyJWT’s PyJWKClient against your issuer JWKS URI. Never publish private keys in JWKS, always pin algorithms when decoding, refresh the client cache when an unknown kid appears after rotation, and treat inbound jku headers as untrusted.

Last updated August 26, 2026

Steps

  1. 1

    Paste your JWKS into the JWKS Viewer to review kids and key types before wiring verification.

  2. 2

    Use Build mode if you only have an SPKI public PEM and need JWKS JSON for local tests.

  3. 3

    In Python, configure PyJWKClient with your OIDC JWKS URI (not a client-supplied jku).

  4. 4

    Decode with algorithms=["RS256"] or ["ES256"] and validate iss, aud, and exp.

  5. 5

    On unknown kid errors, refresh JWKS cache and confirm rotation published both keys.

Code Example

Python
import os
import jwt
from jwt import PyJWKClient

jwks_client = PyJWKClient(os.environ["OIDC_JWKS_URI"])

def verify_access_token(token: str) -> dict:
    signing_key = jwks_client.get_signing_key_from_jwt(token)
    return jwt.decode(
        token,
        signing_key.key,
        algorithms=["RS256"],
        audience=os.environ["API_AUDIENCE"],
        issuer=os.environ["OIDC_ISSUER"],
    )
Open JWKS Viewer

Other languages

Node.jsPythonGoJavaRuby

Related Articles

Jwks In ProductionDebug Jwt Invalid SignatureHow To Validate Jwt Token

Frequently Asked Questions

How does PyJWKClient pick a key?

It reads kid from the JWT header and selects the matching JWK from the remote JWKS. Inspect your document in the JWKS Viewer to confirm kids match what issuers put on tokens.

Should I hardcode JWKS JSON in Python?

Only for offline unit tests. Production services should fetch the issuer JWKS URI over HTTPS with caching, using JSON you previously validated in the viewer during incidents.

What if PyJWT raises an unknown kid error?

Refresh the JWKS cache and check that rotation published the new public key. Use the viewer to compare the live JWKS document against the kid on the failing token.

Can cryptography load PEM exported from the viewer?

Yes. Export SPKI public PEM from View mode and load it with cryptography serialization helpers, or keep using JWK via PyJWK when possible.