How to use JWKS with Ruby

Use the JWKS Viewer to inspect or build public JWKS documents, then verify RS256/ES256 tokens in Ruby with ruby-jwt against your issuer JWKS. Keep private keys out of published JWKS, always specify the algorithm allowlist, cache JWKS responses so rotation does not hammer your IdP, and ignore per-token jku values from clients.

Last updated August 26, 2026

Steps

  1. 1

    Paste JWKS JSON into the JWKS Viewer and verify kid/kty/alg metadata.

  2. 2

    Build a JWKS from public PEM if you are standing up a new issuer for labs.

  3. 3

    In Ruby, fetch or cache JWKS from your configured JWKS URI and select keys by kid.

  4. 4

    Decode with ruby-jwt using algorithms: ["RS256"] (or ES256) and validate claims.

  5. 5

    On rotation, serve both keys until old tokens expire.

Code Example

Ruby
require 'jwt'
require 'net/http'
require 'json'

jwks = JSON.parse(Net::HTTP.get(URI(ENV.fetch('OIDC_JWKS_URI'))))
header = JWT.decode(access_token, nil, false).last
jwk_hash = jwks['keys'].find { |k| k['kid'] == header['kid'] }
raise 'unknown kid' unless jwk_hash

jwk = JWT::JWK.import(jwk_hash)
payload, = JWT.decode(
  access_token,
  jwk.public_key,
  true,
  { algorithms: ['RS256'] }
)
Open JWKS Viewer

Other languages

Node.jsPythonGoJavaRuby

Related Articles

Jwks In ProductionDebug Jwt Invalid SignatureHow To Validate Jwt Token

Frequently Asked Questions

How should Ruby select a JWKS key?

Decode the unprotected header to read kid (without trusting the signature yet), find the matching JWK, then verify with that public key and an algorithms allowlist.

Is Net::HTTP enough for production JWKS?

It works for simple cases, but production apps should cache JWKS, use HTTPS carefully, and refresh on unknown kid. Validate documents in the JWKS Viewer during incidents.

Can ruby-jwt import PEM from the viewer?

Yes. Export SPKI public PEM and load it with OpenSSL::PKey, or import JWK hashes directly via JWT::JWK.import after inspecting them in the viewer.

Should Rails apps trust jku?

No. Configure the issuer JWKS URI in credentials/ENV. Ignore per-token jku to prevent remote key injection.