Intermediate LevelAuthentication & Authorization
How do JWKS (JSON Web Key Sets) endpoints enable zero-downtime key rotation?
❓ Interview Prompt: Explain RFC 7517 JWKS endpoints, kid (Key ID) matching, public key caching, and background key rotation.
JSON Web Key Set (JWKS) (RFC 7517) is a standard endpoint ('/.well-known/jwks.json') exposed by Identity Providers that publishes public keys used to verify signed JWTs.
Zero-Downtime Key Rotation Architecture:
1
Key ID ('kid') Header: Every JWT header includes a 'kid' specifying which key signed the token.
2
JWKS Key Array: The JWKS endpoint returns an array of active public keys:
'{ "keys": [ { "kty": "RSA", "kid": "key-2026-01", ... }, { "kty": "RSA", "kid": "key-2026-02", ... } ] }'
3
Dynamic Fetching & Caching: Microservices fetch and cache public keys locally. When a JWT arrives with a new 'kid', the service refreshes its JWKS cache and matches the public key seamlessly!
Code Implementation Example
typescript
import jwksClient from 'jwks-rsa';
// Configuring JWKS client with caching and rate limiting
const client = jwksClient({
jwksUri: 'https://auth.company.com/.well-known/jwks.json',
cache: true,
rateLimit: true,
jwksRequestsPerMinute: 10
});
async function getPublicKeyByKid(kid: string): Promise<string> {
const key = await client.getSigningKey(kid);
return key.getPublicKey();
}💡Dynamic public key lookup via JWKS endpoint using kid header matching.
🎯 Interview Key Takeaway
JWKS endpoints publish active public keys matched by token kid headers, enabling zero-downtime key rotation across microservices.
#JWKS#Key Rotation#RFC 7517#Public Key#Intermediate
Back to all Authentication & Authorization Questions→