All IAM glossary termsFundamentals · glossary
JSON Web Key Set (JWKS)
Also known as: JWKS · JSON Web Key Set
Definition
A JSON Web Key Set (JWKS, RFC 7517) is a JSON document containing the public keys an issuer uses to sign tokens — typically exposed at `/.well-known/jwks.json` or a discovery-document-specified URL.
In more depth
JWKS lets a token verifier fetch the issuer's public keys + match by key id (kid) in the token header. This separates key distribution from token issuance and supports clean key rotation.
For OIDC: the discovery document declares `jwks_uri`; verifiers cache the JWKS and refresh on cache miss or known kid. Best practice: cache by kid, refresh on miss, and reject if the kid is unknown after refresh.
Want the work, not just the definition?