VersolaVersola/docs
versola.kzGitHub
RUEN

RFC 7517 — JSON Web Key

JWKS endpoint for public key distribution and JWT verification

Specification: RFC 7517

JSON Web Key (JWK) defines a JSON format for representing cryptographic keys. Versola exposes a JWKS endpoint so that resource servers can fetch public keys and verify JWT signatures without contacting the authorization server on every request.

JWKS Endpoint

  • GET /.well-known/jwks.json endpoint (Section 5)
  • Content-Type: application/json response
  • Cache-Control: public, max-age=86400 — keys are publicly cacheable
  • Multiple keys in the set for zero-downtime key rotation

RSA Key Fields (Section 6.3)

  • kty — key type (RSA)
  • use — key usage (sig — signature verification)
  • alg — intended algorithm (RS256)
  • kid — key identifier (matched against JWT kid header)
  • n — RSA modulus (Base64URL-encoded)
  • e — RSA public exponent (Base64URL-encoded)

Key Types

  • RSA keys (kty: "RSA") — currently the only supported type
  • EC keys (kty: "EC", P-256/P-384) — not yet implemented
  • OKP keys (kty: "OKP", Ed25519) — not yet implemented

Optional Fields

  • x5c — X.509 certificate chain — not included
  • x5t — X.509 certificate SHA-1 thumbprint — not included
  • x5u — X.509 certificate URL — not included

Key Rotation

  • Multiple keys in JWKS endpoint — all active public keys returned
  • kid header matching — JWT verification selects correct key from the set
  • Zero-downtime rotation — old tokens remain valid during rotation