v1oauth context
Public keys
GET /v1/oauth/jwks — the JWKS key set, cacheable for 5 minutes.
GET {issuer}/jwks returns the signing key set. Resource servers pick the key matching the token's kid header and verify locally.
Request
No parameters, no authentication.
curl 'https://id.example.com/v1/oauth/jwks'Response
{
"keys": [
{
"kty": "EC",
"crv": "P-256",
"kid": "2026-11-01",
"x": "...",
"y": "...",
"use": "sig",
"alg": "ES256"
}
]
}| Field | Notes |
|---|---|
kid | Key identifier; referenced by the token header |
use | Always sig |
alg | Signing algorithm |
Caching
The response carries Cache-Control: public, max-age=300.
Why caching is allowed here
The opposite of token responses: this payload is public keys, not credentials. Every resource server needs a key by kid, and not caching would make this endpoint carry the verification load of the whole platform.
The window is kept at 5 minutes so that a key rotation (new kid) propagates quickly; clients that meet an unknown kid refetch immediately, and the 5 minutes are only a backstop.
During key rotation
| Situation | Handling |
|---|---|
Token kid present in the set | Verify normally |
Token kid missing from the set | Refetch once; if still missing, treat the token as invalid |
| Both old and new key present | Normal; both are valid during the rotation window |
Related
- What is inside a token: Tokens
- When you need real-time revocation checks: Introspection