A key identifier, written as kid, names the cryptographic key used to sign a JWT. Providers assign it so verifiers can select the matching key. section 7.2.2 section 8.4.2
During validation, read kid from the JWT header, find the matching public key in the provider’s JWKS response, and use that key to verify the signature. This supports key rotation without placing a public key in the application filesystem. section 8.7 section 8.4.2
Matching a token to a signing key
A token header containing "alg": "RS256" and "kid": "080E8CtRFAnnLlgK3dk8Y" points to the JWK carrying the same kid. A JWT client can then obtain that signing key from the configured JWKS endpoint before decoding the token.
Listing 7.1 Example JOSE header
{
"typ": "JWT",
"alg": "RS256",
"kid": "080E8CtRFAnnLlgK3dk8Y"
}
Inspect the compact JOSE header example showing kid alongside typ and alg. section 7.2.2
