What is JWKS?
A JSON Web Key Set is a document listing the public keys an issuer uses to sign tokens. Verifiers fetch it over HTTPS and use it to check signatures, matching the token’s key id against a key in the set.
It exists so that signature verification does not require a shared secret. The signer keeps the private key; everyone else reads the public half from a well-known URL.
It also makes rotation survivable. Publish the new key alongside the old, start signing with the new one, and remove the old after existing tokens expire — verifiers pick up the change on their next fetch.
A trusted issuer registers a JWKS URI, which must be HTTPS and is cached for five minutes. Production environments additionally require each key to be explicitly approved, so a rotation at the issuer cannot silently change who may mint tokens.
Related terms
- Token exchange — Trading a token issued by one system for a scoped token issued by another, so an application can act with narrowed authority.
- Trusted issuer — A registered identity provider whose signed assertions a platform is willing to accept.
- Secret reference — An opaque pointer to a credential held in a vault, used in place of the credential itself.
See it working rather than described.
The product demo runs one agent across three systems and stops at the approval gate.