liveBook · Manning

JSON Web Key Set

As explained in Secure APIs

A JSON Web Key Set is a JSON structure containing a set of JSON Web Keys for cryptographic key distribution.

A JSON Web Key Set (JWKS) is a JSON structure containing public JSON Web Keys (JWKs). An OIDC provider publishes a JWKS endpoint so API services can find the keys needed to validate token signatures. section 8.4.2

A JWK supplies the information needed to load and use a public cryptographic key:

  • kty identifies the key family, use distinguishes encryption from signature verification, and kid identifies the key. section 8.4.2
  • RSA keys include n, the modulus, and e, the public exponent; certificate-related fields can include x5t and x5c. section 8.4.2
  • Token validation uses the JWT header's kid to select a matching key, then verifies the signature and claims. section 8.7
{
  "kty": "RSA",
  "use": "sig",
  "n": "1F72TCRTs6TOXp3pN3sczKIw6OlZtuu_IV5nyrv3OpXEwuf_kOxmd-Gk2F1AwfTdUdH
MoMa5whwYVTemamUPDcmm_mkSLdKYscGWjsWAJc6BewO2rtecqk_BCWwQ5EVFreAjQVFeq
yUHvg8YJX40T_KFsHAhiOzVp5vxSPxdyKQFTErYS8e4Pwf5rigPVk02IkKPYOE9U71fYFi
eP9OHVbTM34qTzR3dekc9CPz5P05ZFSSs32ZfOCXtMEhyJB2ky5LHqzjbAmE8ahXdZbo9V
U9juk4THKbHa-s1_1El8frRwGm3FANMePZDGNT73h-Q6n_QFEhewv-dMWHdCB8-NQ",
  "e": "AQAB",
  "kid": "080E8CtRFAnnLlgK3dk8Y",
  "x5t": "bGbu8vMg1fEwLf8eJ-pEltvuEKw",
  "x5c": ["MIIDCTCCAfGgAwIBAgIJAqiJX3yiNIe0MA0GCSqGSIb3DQEBCwUAMCIxIDAeBgNVB
AMTF2FwaXRocmVhdHMuZXUuYXV0aDAuY29tMB4XDTI0MDMxMzA5MjYxMVoXDTM3MTEyMDA
5MjYxMVowIjEgMB4GA1UEAxMXYXBpdGhyZWF0cy5ldS5hdXRoMC5jb20wggEiMA0GCSqGS
Ib3DQEBAQUAA4IBDwAwggEKAoIBAQDUXvZMJFOzpM5enek3exzMojDo6Vm2678hXmfKu/c
6lcTC5/+Q7GZ34aTYXUDB9N1R0cygxrnCHBhVN6ZqZQ8Nyab+aRIt0pixwZaOxYAlzoF7A
7au15yqT8EJbBDkRUWt4CNBUV6rJQe+DxglfjRP8oWwcCGI7NWnm/FI/F3IpAVMSthLx7g
/B/muKA9WTTYiQo9g4T1TvV9gWJ4/04dVtMzfipPNHd16Rz0I/Pk/TlkVJKzfZl84Je0wS
HIkHaTLkserONsCYTxqFd1luj1VT2O6ThMcpsdr6zX/USXx+tHAabcUA0x49kMY1PveH5D
qf9AUSF7C/50xYd0IHz41AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEF
PELWkxRblScUr4R+HX0TKM9rM9vMA4GA1UdDwEB/wQEAwIChDANBgkqhkiG9w0BAQsFAAO
CAQEADECVWKF7+OtKpJoXpv2CpbnLraoazNMJUJ+Y4CHpIJt/ikL8GT5psRL+zQ5089dMr
VDPr4r3vmIq99NhvAnF7KUTGdSNqIQf7uBQffJqxfSNCrf0a6yitgDtCHEXxTNp7E7iesE
HNuF26J31s/3iiEY9qjvxtiyPG5sCViLFS8Jt593oiwm5s2e1egaS4LeD75S8+zxoN+MVf
AUmq9DF/XHrM4MurTbJ0A64rb/ngGMocFUh3ZvtbZt0ylgrQ6Se3lQWSqkmg2lbBpjWll7
bvk3hkM6Tzms+BFBYgRADCRa5Npg7ojqhGc9nnX8EkuGaanmvsauK1i4r8MBAC4fdkQ=="
],
  "alg": "RS256"
}

Inspect a concrete RSA signing key, including its type, purpose, identifier, modulus, exponent, and certificate fields. section 8.4.2

How Secure APIs covers it

How deep it goes
Explains endpoint discovery, JWK fields, kid-based lookup, signature checks, claims, and fixed algorithm selection.
Examples
Uses an Auth0 JWKS endpoint, an RSA JWK, a JWT kid value, and a PyJWT validation fragment.
What it assumes
Assumes JWT and OIDC terminology while defining JWK fields and showing how providers publish validation keys.
What you can do after
Operate token validation with PyJWT by selecting the JWKS key and checking algorithm, audience, issuer, signature, and claims.
How it connects
Connects OIDC discovery endpoints, JSON Web Keys, JWT headers, token claims, signature validation, and RBAC.
Cover of Secure APIs
liveBookmanning.com
Read Secure APIs on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.