JWKS
JSON Web Key Set
A JSON document of public keys that a verifier fetches from a trusted issuer configuration to check token signatures; the verifier needs an explicit key-refresh policy.
- Defined in
- RFC 7517
Covered in
JWT validation: algorithms, keys, claims and key rollover
Validate a JWT against a fixed algorithm, trusted keys and the expected issuer, audience and type, reject the known header attacks, and rotate signing keys without accepting arbitrary keys or breaking valid tokens.
Defend JWTs against forgery, confusion and replay
Verify a JWT as an issuer-, type- and audience-bound assertion with an algorithm allowlist and trusted keys, closing the alg "none", key-confusion, header-injection, weak-secret and replay attacks.
Practice: JWT validation lab: Validate the purpose and audience of a token · JWT verification lab: Verify a JWT before trusting it · Local project: Secure a real HTTP API · Local project: Verify tokens through rotation and revocation