JWKS (JSON Web Key Set)
A JSON Web Key Set (JWKS) is a JSON object, defined by the JWK Set structure in RFC 7517, containing a single "keys" member whose value is an array of JSON Web Keys -- each one a public key (or, less commonly, a shared secret) represented as JSON, carrying fields like its key type, intended use, and a key ID ("kid"). An authorization server typically publishes its JWKS at a URL referenced by its own configuration -- the jwks_uri field in its OAuth 2.0 Authorization Server Metadata -- so any resource server that receives a JWT it issued can fetch the current set of valid public keys, match the JWT header's kid to the right entry, and verify the token's signature without that key ever having been shared out of band or hardcoded into the resource server. Publishing a set rather than a single key is what makes key rotation possible without downtime: the authorization server can add a new signing key to the published set, start using it for newly issued tokens, and only remove the old key once every token it signed has expired, so a resource server that re-fetches the JWKS periodically never has to be updated by hand to keep verifying correctly.
By AdminKit team, Netbase JSC · Updated