wellknownjwksjson

Well-known JWKS JSON refers to the publicly accessible JSON Web Key Set served at the well-known URI /.well-known/jwks.json by OAuth 2.0 and OpenID Connect providers. The well-known concept, defined by RFC 5785, designates standard locations for retrieval of metadata and related resources. The JWKS endpoint provides the public keys that clients use to verify the signatures of JSON Web Tokens (JWTs) issued by the authorization server. Each key is a JSON Web Key (JWK) entry, and the set is returned as a JSON object with a keys array.

A typical JWKS document looks like a JSON object with a keys property containing an array of JWK objects. Each JWK describes a public key, including fields such as kty (key type), kid (key identifier), use (intended use, e.g., sig), alg (algorithm), and the key material (for RSA, n and e; for EC, crv, x, y).

Clients fetch the JWKS to obtain the public keys, cache them, and select the appropriate key using the key ID (kid) found in the JWT header. The chosen key is then used to verify the token’s signature, after which standard claim validation (such as exp, iss, aud) is performed. Key rotation is common, so clients should handle multiple keys and cached entries with appropriate expiration.

In OpenID Connect discovery, provider metadata often includes a jwks_uri property that points to this endpoint, enabling clients to automatically locate the public keys required to verify tokens issued by the provider.

Security considerations include serving the endpoint over HTTPS, managing key rotation efficiently, and validating tokens thoroughly.