JWKS
acronymsecuritycryptography
Stands for: JSON Web Key Set
A published set of keys used to verify signed tokens.
JSON Web Key Set is a JSON document listing the public keys (as JWKs) a service uses to sign its tokens. Relying parties fetch the JWKS to verify JWT signatures and to follow key rotation without manual reconfiguration.
A JWKS is how a service publishes the public keys needed to verify its tokens, usually at a well-known URL that clients fetch and cache. It exists so that key rotation does not require coordinating a configuration change with every consumer, which was the operational nightmare of shipping certificates by hand.
Rotation works because the set holds several keys at once and each token names the one that signed it in its header. Publish the new key, wait for consumers to refresh their cache, then start signing with it, and retire the old one only after every token signed by it has expired. Doing those steps in the wrong order is the classic self-inflicted outage: signing with a key nobody has fetched yet fails every validation instantly.
The caching behaviour is where subtle failures live. Cache too aggressively and a rotation breaks you; refetch on every token and you have made your authentication depend on an outbound HTTP call in the hot path. The usual answer is caching with a bounded lifetime plus a single refetch when an unknown key identifier appears, with a rate limit so a flood of bogus identifiers cannot turn into a self-inflicted denial of service.
Also known as: jwks