A private key is the secret half of an asymmetric cryptographic key pair. It creates digital signatures, while the matching public key validates them. section 8.2
For JWT authentication, the issuer signs a token with the private key and the API checks the signature with the public key. PS256 uses RSA keys and produces probabilistic signatures, reducing the risk of forging tokens by cracking the signing key. section 8.2 section 8.3
A practical private-key workflow is:
- Generate an RSA key pair with OpenSSL’s genpkey command, writing the private key to private_key.pem and the public key to public_key.pem. section 8.2
- Load the PEM-formatted private key with Python’s cryptography serialization.load_pem_private_key function. section 8.2
- Pass the loaded key to PyJWT with algorithm="PS256" when issuing a JWT. section 8.2
- Give the corresponding public key to the validator and restrict accepted algorithms to PS256 while checking issuer and audience claims. section 8.3
Signing a JWT with a loaded private key
Load private_key.pem with load_pem_private_key, then call jwt.encode(payload=payload, key=private_key, algorithm="PS256"). The resulting token can be checked with the matching public key. section 8.2 section 8.3
openssl genpkey -algorithm RSA -out private_key.pem \ -outpubkey public_key.pem -pkeyopt rsa_keygen_bits:3072
Inspect the compact OpenSSL command that generates a 3072-bit RSA private key and its public-key output. section 8.2
