[{"data":1,"prerenderedAt":1078},["ShallowReactive",2],{"navigation":3,"-jwk-jwk-sets":167,"-jwk-jwk-sets-surround":1075},[4,22,78,106,141,148],{"title":5,"path":6,"stem":7,"children":8},"Introduction","\u002Fgetting-started","0.Getting-Started\u002F0.index",[9,10,14,18],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13},"Installation","\u002Fgetting-started\u002Finstallation","0.Getting-Started\u002F1.installation",{"title":15,"path":16,"stem":17},"Quickstart","\u002Fgetting-started\u002Fquickstart","0.Getting-Started\u002F2.quickstart",{"title":19,"path":20,"stem":21},"Core concepts","\u002Fgetting-started\u002Fcore-concepts","0.Getting-Started\u002F3.core-concepts",{"title":23,"path":24,"stem":25,"children":26,"icon":28},"JWT","\u002Fjwt","1.JWT\u002F0.index",[27,29,52],{"title":23,"path":24,"stem":25,"icon":28},"i-carbon-certificate",{"title":30,"path":31,"stem":32,"children":33,"icon":35},"JWS","\u002Fjwt\u002Fjws","1.JWT\u002F1.JWS\u002F0.index",[34,36,40,44,48],{"title":30,"path":31,"stem":32,"icon":35},"i-carbon-document-signed",{"title":37,"path":38,"stem":39},"Signing","\u002Fjwt\u002Fjws\u002Fsigning","1.JWT\u002F1.JWS\u002F1.signing",{"title":41,"path":42,"stem":43},"Verifying","\u002Fjwt\u002Fjws\u002Fverifying","1.JWT\u002F1.JWS\u002F2.verifying",{"title":45,"path":46,"stem":47},"Multi-signature","\u002Fjwt\u002Fjws\u002Fmulti-signature","1.JWT\u002F1.JWS\u002F3.multi-signature",{"title":49,"path":50,"stem":51},"Algorithms","\u002Fjwt\u002Fjws\u002Falgorithms","1.JWT\u002F1.JWS\u002F4.algorithms",{"title":53,"path":54,"stem":55,"children":56,"icon":58},"JWE","\u002Fjwt\u002Fjwe","1.JWT\u002F2.JWE\u002F0.index",[57,59,63,67,71,75],{"title":53,"path":54,"stem":55,"icon":58},"i-carbon-locked",{"title":60,"path":61,"stem":62},"Encrypting","\u002Fjwt\u002Fjwe\u002Fencrypting","1.JWT\u002F2.JWE\u002F1.encrypting",{"title":64,"path":65,"stem":66},"Decrypting","\u002Fjwt\u002Fjwe\u002Fdecrypting","1.JWT\u002F2.JWE\u002F2.decrypting",{"title":68,"path":69,"stem":70},"Multi-recipient","\u002Fjwt\u002Fjwe\u002Fmulti-recipient","1.JWT\u002F2.JWE\u002F3.multi-recipient",{"title":72,"path":73,"stem":74},"ECDH-ES and end-to-end encryption","\u002Fjwt\u002Fjwe\u002Fecdh-es","1.JWT\u002F2.JWE\u002F4.ecdh-es",{"title":49,"path":76,"stem":77},"\u002Fjwt\u002Fjwe\u002Falgorithms","1.JWT\u002F2.JWE\u002F5.algorithms",{"title":79,"path":80,"stem":81,"children":82,"icon":84},"Examples","\u002Fexamples","10.Examples\u002F0.index",[83,85,90,94,98,102],{"title":79,"path":80,"stem":81,"icon":84},"i-carbon-code-reference",{"title":86,"path":87,"stem":88,"icon":89},"Authentication basics","\u002Fexamples\u002Fauthentication-basics","10.Examples\u002F1.authentication-basics","i-lucide-code",{"title":91,"path":92,"stem":93,"icon":89},"Consuming a JWKS endpoint","\u002Fexamples\u002Fjwks-endpoint","10.Examples\u002F2.jwks-endpoint",{"title":95,"path":96,"stem":97,"icon":89},"Refresh token pattern","\u002Fexamples\u002Frefresh-token-pattern","10.Examples\u002F3.refresh-token-pattern",{"title":99,"path":100,"stem":101,"icon":89},"End-to-end encryption","\u002Fexamples\u002Fend-to-end-encryption","10.Examples\u002F4.end-to-end-encryption",{"title":103,"path":104,"stem":105,"icon":89},"Signed receipts","\u002Fexamples\u002Fsigned-receipts","10.Examples\u002F5.signed-receipts",{"title":107,"path":108,"stem":109,"children":110,"icon":112},"JWK","\u002Fjwk","2.JWK\u002F0.index",[111,113,117,121,125,129,133,137],{"title":107,"path":108,"stem":109,"icon":112},"i-carbon-two-factor-authentication",{"title":114,"path":115,"stem":116},"Generating keys","\u002Fjwk\u002Fgenerating","2.JWK\u002F1.generating",{"title":118,"path":119,"stem":120},"Importing and exporting","\u002Fjwk\u002Fimport-export","2.JWK\u002F2.import-export",{"title":122,"path":123,"stem":124},"PEM conversion","\u002Fjwk\u002Fpem","2.JWK\u002F3.pem",{"title":126,"path":127,"stem":128},"Key wrapping","\u002Fjwk\u002Fwrapping","2.JWK\u002F4.wrapping",{"title":130,"path":131,"stem":132},"Password derivation","\u002Fjwk\u002Fpassword-derivation","2.JWK\u002F5.password-derivation",{"title":134,"path":135,"stem":136},"JWK Sets","\u002Fjwk\u002Fjwk-sets","2.JWK\u002F6.jwk-sets",{"title":138,"path":139,"stem":140},"JWK cache","\u002Fjwk\u002Fcache","2.JWK\u002F7.cache",{"title":142,"path":143,"stem":144,"children":145,"icon":147},"Utilities","\u002Futilities","3.Utilities\u002F0.index",[146],{"title":142,"path":143,"stem":144,"icon":147},"i-carbon-tool-box",{"title":149,"path":150,"stem":151,"children":152,"icon":154},"Adapters","\u002Fadapters","99.Adapters\u002F0.index",[153,155,159,163],{"title":149,"path":150,"stem":151,"icon":154},"i-carbon-plug",{"title":156,"path":157,"stem":158},"H3 sessions","\u002Fadapters\u002Fh3-sessions","99.Adapters\u002F1.h3-sessions",{"title":160,"path":161,"stem":162},"Lifecycle hooks","\u002Fadapters\u002Fhooks","99.Adapters\u002F2.hooks",{"title":164,"path":165,"stem":166},"Lower-level functions","\u002Fadapters\u002Flower-level","99.Adapters\u002F3.lower-level",{"id":168,"title":134,"body":169,"description":200,"extension":1070,"meta":1071,"navigation":1072,"path":135,"seo":1073,"stem":136,"__hash__":1074},"content\u002F2.JWK\u002F6.jwk-sets.md",{"type":170,"value":171,"toc":1060},"minimark",[172,194,341,348,353,364,460,465,473,520,523,529,547,550,692,695,708,720,724,760,767,771,774,901,912,918,922,931,1034,1038,1056],[173,174,175,176,180,181,188,189,193],"p",{},"A ",[177,178,179],"strong",{},"JWK Set"," (",[182,183,187],"a",{"href":184,"rel":185},"https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc7517#section-5",[186],"nofollow","RFC 7517 §5",") is a JSON object with a ",[190,191,192],"code",{},"keys"," array. It's the canonical way to publish multiple keys together — one for signing, several for rotation, a mix of algorithms — and to consume them as a single entity.",[195,196,201],"pre",{"className":197,"code":198,"language":199,"meta":200,"style":200},"language-json shiki shiki-themes github-light github-dark github-dark","{\n  \"keys\": [\n    { \"kty\": \"RSA\", \"kid\": \"2025-q1\", \"alg\": \"RS256\", \"n\": \"...\", \"e\": \"AQAB\" },\n    { \"kty\": \"RSA\", \"kid\": \"2025-q2\", \"alg\": \"RS256\", \"n\": \"...\", \"e\": \"AQAB\" }\n  ]\n}\n","json","",[190,202,203,212,222,282,329,335],{"__ignoreMap":200},[204,205,208],"span",{"class":206,"line":207},"line",1,[204,209,211],{"class":210},"slsVL","{\n",[204,213,215,219],{"class":206,"line":214},2,[204,216,218],{"class":217},"suiK_","  \"keys\"",[204,220,221],{"class":210},": [\n",[204,223,225,228,231,234,238,241,244,246,249,251,254,256,259,261,264,266,269,271,274,276,279],{"class":206,"line":224},3,[204,226,227],{"class":210},"    { ",[204,229,230],{"class":217},"\"kty\"",[204,232,233],{"class":210},": ",[204,235,237],{"class":236},"sfrk1","\"RSA\"",[204,239,240],{"class":210},", ",[204,242,243],{"class":217},"\"kid\"",[204,245,233],{"class":210},[204,247,248],{"class":236},"\"2025-q1\"",[204,250,240],{"class":210},[204,252,253],{"class":217},"\"alg\"",[204,255,233],{"class":210},[204,257,258],{"class":236},"\"RS256\"",[204,260,240],{"class":210},[204,262,263],{"class":217},"\"n\"",[204,265,233],{"class":210},[204,267,268],{"class":236},"\"...\"",[204,270,240],{"class":210},[204,272,273],{"class":217},"\"e\"",[204,275,233],{"class":210},[204,277,278],{"class":236},"\"AQAB\"",[204,280,281],{"class":210}," },\n",[204,283,285,287,289,291,293,295,297,299,302,304,306,308,310,312,314,316,318,320,322,324,326],{"class":206,"line":284},4,[204,286,227],{"class":210},[204,288,230],{"class":217},[204,290,233],{"class":210},[204,292,237],{"class":236},[204,294,240],{"class":210},[204,296,243],{"class":217},[204,298,233],{"class":210},[204,300,301],{"class":236},"\"2025-q2\"",[204,303,240],{"class":210},[204,305,253],{"class":217},[204,307,233],{"class":210},[204,309,258],{"class":236},[204,311,240],{"class":210},[204,313,263],{"class":217},[204,315,233],{"class":210},[204,317,268],{"class":236},[204,319,240],{"class":210},[204,321,273],{"class":217},[204,323,233],{"class":210},[204,325,278],{"class":236},[204,327,328],{"class":210}," }\n",[204,330,332],{"class":206,"line":331},5,[204,333,334],{"class":210},"  ]\n",[204,336,338],{"class":206,"line":337},6,[204,339,340],{"class":210},"}\n",[173,342,343,344,347],{},"This is the format OAuth\u002FOIDC providers publish at ",[190,345,346],{},"\u002F.well-known\u002Fjwks.json",". It's also how you'd persist your own rotating signing keys in a config file or database.",[349,350,352],"h2",{"id":351},"consuming-a-set","Consuming a set",[173,354,355,356,359,360,363],{},"Pass a JWK Set to ",[190,357,358],{},"verify()"," or ",[190,361,362],{},"decrypt()"," and the library handles the selection for you:",[195,365,370],{"className":366,"code":367,"filename":368,"language":369,"meta":200,"style":200},"language-ts shiki shiki-themes github-light github-dark github-dark","const jwks = await fetch(\"https:\u002F\u002Fauth.example.com\u002F.well-known\u002Fjwks.json\").then((r) => r.json());\n\nconst { payload } = await verify(tokenFromProvider, jwks);\n\u002F\u002F ↑ unjwt picks the right key from the set based on the token's `kid`\n","from-endpoint.ts","ts",[190,371,372,424,430,454],{"__ignoreMap":200},[204,373,374,378,381,384,387,391,394,397,400,403,406,410,413,416,419,421],{"class":206,"line":207},[204,375,377],{"class":376},"so5gQ","const",[204,379,380],{"class":217}," jwks",[204,382,383],{"class":376}," =",[204,385,386],{"class":376}," await",[204,388,390],{"class":389},"shcOC"," fetch",[204,392,393],{"class":210},"(",[204,395,396],{"class":236},"\"https:\u002F\u002Fauth.example.com\u002F.well-known\u002Fjwks.json\"",[204,398,399],{"class":210},").",[204,401,402],{"class":389},"then",[204,404,405],{"class":210},"((",[204,407,409],{"class":408},"sQHwn","r",[204,411,412],{"class":210},") ",[204,414,415],{"class":376},"=>",[204,417,418],{"class":210}," r.",[204,420,199],{"class":389},[204,422,423],{"class":210},"());\n",[204,425,426],{"class":206,"line":214},[204,427,429],{"emptyLinePlaceholder":428},true,"\n",[204,431,432,434,437,440,443,446,448,451],{"class":206,"line":224},[204,433,377],{"class":376},[204,435,436],{"class":210}," { ",[204,438,439],{"class":217},"payload",[204,441,442],{"class":210}," } ",[204,444,445],{"class":376},"=",[204,447,386],{"class":376},[204,449,450],{"class":389}," verify",[204,452,453],{"class":210},"(tokenFromProvider, jwks);\n",[204,455,456],{"class":206,"line":284},[204,457,459],{"class":458},"sCsY4","\u002F\u002F ↑ unjwt picks the right key from the set based on the token's `kid`\n",[461,462,464],"h3",{"id":463},"selection-rules","Selection rules",[173,466,467,468,472],{},"When a JWKSet is passed (directly or returned from a ",[182,469,471],{"href":470},"\u002Fjwt\u002Fjws\u002Fverifying#dynamic-key-resolution-jwklookupfunction","lookup function","):",[474,475,477,491,506],"steps",{"level":476},"4",[478,479,480,487,488,490],"h4",{},[177,481,482,483,486],{},"Token carries a ",[190,484,485],{},"kid"," header"," — only keys with that exact ",[190,489,485],{}," are tried. Typically one match, so this is a fast O(1) path with no retry.",[478,492,493,498,499,502,503,505],{},[177,494,495,496],{},"Token has no ",[190,497,485],{}," — every key in the set whose ",[190,500,501],{},"alg"," matches (or is compatible with) the token's ",[190,504,501],{}," is tried in order. The first one to verify successfully wins.",[478,507,508,511,512,515,516,519],{},[177,509,510],{},"No matching candidates at all"," — throws ",[190,513,514],{},"JWTError(\"ERR_JWK_KEY_NOT_FOUND\")"," ",[177,517,518],{},"before any crypto runs",".",[173,521,522],{},"This is the mechanism behind transparent key rotation: add a new key to the set, retire the old one after a grace period, and your verification code never changes.",[349,524,526],{"id":525},"getjwksfromset",[190,527,528],{},"getJWKsFromSet",[195,530,532],{"className":366,"code":531,"language":369,"meta":200,"style":200},"getJWKsFromSet(jwkSet, filter?)\n",[190,533,534],{"__ignoreMap":200},[204,535,536,538,541,544],{"class":206,"line":207},[204,537,528],{"class":389},[204,539,540],{"class":210},"(jwkSet, filter",[204,542,543],{"class":376},"?",[204,545,546],{"class":210},")\n",[173,548,549],{},"Returns an array of JWKs from a set, optionally narrowed by a predicate:",[195,551,554],{"className":366,"code":552,"filename":553,"language":369,"meta":200,"style":200},"import { getJWKsFromSet } from \"unjwt\u002Fjwk\";\n\nconst all = getJWKsFromSet(jwkSet);\n\u002F\u002F → all keys as JWK[]\n\nconst hmacOnly = getJWKsFromSet(jwkSet, (k) => k.kty === \"oct\");\n\u002F\u002F → only symmetric keys\n\nconst current = getJWKsFromSet(jwkSet, (k) => k.kid?.startsWith(\"2025-\") ?? false);\n\u002F\u002F → only keys whose kid matches a prefix\n","filter.ts",[190,555,556,573,577,592,597,601,634,640,645,686],{"__ignoreMap":200},[204,557,558,561,564,567,570],{"class":206,"line":207},[204,559,560],{"class":376},"import",[204,562,563],{"class":210}," { getJWKsFromSet } ",[204,565,566],{"class":376},"from",[204,568,569],{"class":236}," \"unjwt\u002Fjwk\"",[204,571,572],{"class":210},";\n",[204,574,575],{"class":206,"line":214},[204,576,429],{"emptyLinePlaceholder":428},[204,578,579,581,584,586,589],{"class":206,"line":224},[204,580,377],{"class":376},[204,582,583],{"class":217}," all",[204,585,383],{"class":376},[204,587,588],{"class":389}," getJWKsFromSet",[204,590,591],{"class":210},"(jwkSet);\n",[204,593,594],{"class":206,"line":284},[204,595,596],{"class":458},"\u002F\u002F → all keys as JWK[]\n",[204,598,599],{"class":206,"line":331},[204,600,429],{"emptyLinePlaceholder":428},[204,602,603,605,608,610,612,615,618,620,622,625,628,631],{"class":206,"line":337},[204,604,377],{"class":376},[204,606,607],{"class":217}," hmacOnly",[204,609,383],{"class":376},[204,611,588],{"class":389},[204,613,614],{"class":210},"(jwkSet, (",[204,616,617],{"class":408},"k",[204,619,412],{"class":210},[204,621,415],{"class":376},[204,623,624],{"class":210}," k.kty ",[204,626,627],{"class":376},"===",[204,629,630],{"class":236}," \"oct\"",[204,632,633],{"class":210},");\n",[204,635,637],{"class":206,"line":636},7,[204,638,639],{"class":458},"\u002F\u002F → only symmetric keys\n",[204,641,643],{"class":206,"line":642},8,[204,644,429],{"emptyLinePlaceholder":428},[204,646,648,650,653,655,657,659,661,663,665,668,671,673,676,678,681,684],{"class":206,"line":647},9,[204,649,377],{"class":376},[204,651,652],{"class":217}," current",[204,654,383],{"class":376},[204,656,588],{"class":389},[204,658,614],{"class":210},[204,660,617],{"class":408},[204,662,412],{"class":210},[204,664,415],{"class":376},[204,666,667],{"class":210}," k.kid?.",[204,669,670],{"class":389},"startsWith",[204,672,393],{"class":210},[204,674,675],{"class":236},"\"2025-\"",[204,677,412],{"class":210},[204,679,680],{"class":376},"??",[204,682,683],{"class":217}," false",[204,685,633],{"class":210},[204,687,689],{"class":206,"line":688},10,[204,690,691],{"class":458},"\u002F\u002F → only keys whose kid matches a prefix\n",[173,693,694],{},"Useful for:",[696,697,698,702,705],"ul",{},[699,700,701],"li",{},"Picking the current signing key from a set that contains historical keys too.",[699,703,704],{},"Building a multi-recipient JWE targeted at a specific subset of keyholders.",[699,706,707],{},"Debugging — inspecting what's actually in a JWK Set.",[709,710,711],"warning",{},[173,712,713,716,717,719],{},[190,714,715],{},"getJWKFromSet"," (singular, deprecated) returns the first matching key. Prefer ",[190,718,528],{}," — it composes with array methods and doesn't hide the \"what if there are multiple matches?\" question.",[349,721,723],{"id":722},"key-rotation-a-complete-pattern","Key rotation — a complete pattern",[474,725,726,736,745,751,757],{"level":476},[478,727,728,731,732,735],{},[177,729,730],{},"Issue with key A",", which carries ",[190,733,734],{},"kid: \"2025-q1\"",". Publish your JWKS containing just A.",[478,737,738,180,741,744],{},[177,739,740],{},"Generate key B",[190,742,743],{},"kid: \"2025-q2\"","). Publish JWKS containing both A and B. Don't sign with B yet — verifiers need time to refresh their cache.",[478,746,747,750],{},[177,748,749],{},"Cutover",": start signing with B. Keep publishing both A and B so tokens still in flight validate.",[478,752,753,756],{},[177,754,755],{},"Retire A",": once A's longest-lived token has expired, remove A from JWKS. Only B remains.",[478,758,759],{},"Repeat.",[173,761,762,763,766],{},"On the verifier side, the same ",[190,764,765],{},"verify(token, jwks)"," call works through every step — no code changes. That's the whole point of JWK Sets.",[349,768,770],{"id":769},"publishing-a-jwks-endpoint","Publishing a JWKS endpoint",[173,772,773],{},"If you're on the signing side and want downstream consumers to verify your tokens:",[195,775,778],{"className":366,"code":776,"filename":777,"language":369,"meta":200,"style":200},"import { exportKey } from \"unjwt\u002Fjwk\";\n\n\u002F\u002F Keep private keys server-side only.\n\u002F\u002F Expose the PUBLIC half of each:\napp.get(\"\u002F.well-known\u002Fjwks.json\", async () => {\n  return {\n    keys: [\n      await exportKey(currentPublicCryptoKey, { kid: \"2025-q1\", use: \"sig\" }),\n      await exportKey(previousPublicCryptoKey, { kid: \"2025-q1\", use: \"sig\" }),\n    ],\n  };\n});\n","jwks-endpoint.ts",[190,779,780,793,797,802,807,833,840,845,867,884,889,895],{"__ignoreMap":200},[204,781,782,784,787,789,791],{"class":206,"line":207},[204,783,560],{"class":376},[204,785,786],{"class":210}," { exportKey } ",[204,788,566],{"class":376},[204,790,569],{"class":236},[204,792,572],{"class":210},[204,794,795],{"class":206,"line":214},[204,796,429],{"emptyLinePlaceholder":428},[204,798,799],{"class":206,"line":224},[204,800,801],{"class":458},"\u002F\u002F Keep private keys server-side only.\n",[204,803,804],{"class":206,"line":284},[204,805,806],{"class":458},"\u002F\u002F Expose the PUBLIC half of each:\n",[204,808,809,812,815,817,820,822,825,828,830],{"class":206,"line":331},[204,810,811],{"class":210},"app.",[204,813,814],{"class":389},"get",[204,816,393],{"class":210},[204,818,819],{"class":236},"\"\u002F.well-known\u002Fjwks.json\"",[204,821,240],{"class":210},[204,823,824],{"class":376},"async",[204,826,827],{"class":210}," () ",[204,829,415],{"class":376},[204,831,832],{"class":210}," {\n",[204,834,835,838],{"class":206,"line":337},[204,836,837],{"class":376},"  return",[204,839,832],{"class":210},[204,841,842],{"class":206,"line":636},[204,843,844],{"class":210},"    keys: [\n",[204,846,847,850,853,856,858,861,864],{"class":206,"line":642},[204,848,849],{"class":376},"      await",[204,851,852],{"class":389}," exportKey",[204,854,855],{"class":210},"(currentPublicCryptoKey, { kid: ",[204,857,248],{"class":236},[204,859,860],{"class":210},", use: ",[204,862,863],{"class":236},"\"sig\"",[204,865,866],{"class":210}," }),\n",[204,868,869,871,873,876,878,880,882],{"class":206,"line":647},[204,870,849],{"class":376},[204,872,852],{"class":389},[204,874,875],{"class":210},"(previousPublicCryptoKey, { kid: ",[204,877,248],{"class":236},[204,879,860],{"class":210},[204,881,863],{"class":236},[204,883,866],{"class":210},[204,885,886],{"class":206,"line":688},[204,887,888],{"class":210},"    ],\n",[204,890,892],{"class":206,"line":891},11,[204,893,894],{"class":210},"  };\n",[204,896,898],{"class":206,"line":897},12,[204,899,900],{"class":210},"});\n",[173,902,903,904,907,908,911],{},"In most apps you'd keep the JWK objects themselves in memory or a config store and hand them back — exporting from ",[190,905,906],{},"CryptoKey"," is only needed when you generated with ",[190,909,910],{},"generateKey()"," (non-JWK output) or imported opaquely.",[173,913,914,915,519],{},"Full example: ",[182,916,917],{"href":92},"Consuming a JWKS endpoint →",[349,919,921],{"id":920},"dynamic-resolution-when-you-need-more-than-a-static-set","Dynamic resolution — when you need more than a static set",[173,923,924,925,930],{},"If the set is large, changing frequently, or fetched per-request, use a ",[182,926,927],{"href":470},[190,928,929],{},"JWKLookupFunction"," instead:",[195,932,935],{"className":366,"code":933,"filename":934,"language":369,"meta":200,"style":200},"const { payload } = await verify(\n  token,\n  async (header) => {\n    const jwks = await jwksCache.get(header.iss); \u002F\u002F cached fetch per issuer\n    return jwks; \u002F\u002F return the whole set — library handles selection\n  },\n  { algorithms: [\"RS256\", \"ES256\"] },\n);\n","dynamic.ts",[190,936,937,956,961,977,999,1010,1015,1030],{"__ignoreMap":200},[204,938,939,941,943,945,947,949,951,953],{"class":206,"line":207},[204,940,377],{"class":376},[204,942,436],{"class":210},[204,944,439],{"class":217},[204,946,442],{"class":210},[204,948,445],{"class":376},[204,950,386],{"class":376},[204,952,450],{"class":389},[204,954,955],{"class":210},"(\n",[204,957,958],{"class":206,"line":214},[204,959,960],{"class":210},"  token,\n",[204,962,963,966,968,971,973,975],{"class":206,"line":224},[204,964,965],{"class":376},"  async",[204,967,180],{"class":210},[204,969,970],{"class":408},"header",[204,972,412],{"class":210},[204,974,415],{"class":376},[204,976,832],{"class":210},[204,978,979,982,984,986,988,991,993,996],{"class":206,"line":284},[204,980,981],{"class":376},"    const",[204,983,380],{"class":217},[204,985,383],{"class":376},[204,987,386],{"class":376},[204,989,990],{"class":210}," jwksCache.",[204,992,814],{"class":389},[204,994,995],{"class":210},"(header.iss); ",[204,997,998],{"class":458},"\u002F\u002F cached fetch per issuer\n",[204,1000,1001,1004,1007],{"class":206,"line":331},[204,1002,1003],{"class":376},"    return",[204,1005,1006],{"class":210}," jwks; ",[204,1008,1009],{"class":458},"\u002F\u002F return the whole set — library handles selection\n",[204,1011,1012],{"class":206,"line":337},[204,1013,1014],{"class":210},"  },\n",[204,1016,1017,1020,1022,1024,1027],{"class":206,"line":636},[204,1018,1019],{"class":210},"  { algorithms: [",[204,1021,258],{"class":236},[204,1023,240],{"class":210},[204,1025,1026],{"class":236},"\"ES256\"",[204,1028,1029],{"class":210},"] },\n",[204,1031,1032],{"class":206,"line":642},[204,1033,633],{"class":210},[349,1035,1037],{"id":1036},"see-also","See also",[696,1039,1040,1046,1051],{},[699,1041,1042],{},[182,1043,1045],{"href":1044},"\u002Fjwt\u002Fjws\u002Fverifying#jwkset-automatic-key-rotation","Verifying → JWKSet retry",[699,1047,1048],{},[182,1049,1050],{"href":92},"Examples: JWKS endpoint",[699,1052,1053],{},[182,1054,1055],{"href":161},"Adapters: key rotation via hooks",[1057,1058,1059],"style",{},"html pre.shiki code .slsVL, html code.shiki .slsVL{--shiki-light:#24292E;--shiki-default:#E1E4E8;--shiki-dark:#E1E4E8}html pre.shiki code .suiK_, html code.shiki .suiK_{--shiki-light:#005CC5;--shiki-default:#79B8FF;--shiki-dark:#79B8FF}html pre.shiki code .sfrk1, html code.shiki .sfrk1{--shiki-light:#032F62;--shiki-default:#9ECBFF;--shiki-dark:#9ECBFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .so5gQ, html code.shiki .so5gQ{--shiki-light:#D73A49;--shiki-default:#F97583;--shiki-dark:#F97583}html pre.shiki code .shcOC, html code.shiki .shcOC{--shiki-light:#6F42C1;--shiki-default:#B392F0;--shiki-dark:#B392F0}html pre.shiki code .sQHwn, html code.shiki .sQHwn{--shiki-light:#E36209;--shiki-default:#FFAB70;--shiki-dark:#FFAB70}html pre.shiki code .sCsY4, html code.shiki .sCsY4{--shiki-light:#6A737D;--shiki-default:#6A737D;--shiki-dark:#6A737D}",{"title":200,"searchDepth":214,"depth":214,"links":1061},[1062,1065,1066,1067,1068,1069],{"id":351,"depth":214,"text":352,"children":1063},[1064],{"id":463,"depth":224,"text":464},{"id":525,"depth":214,"text":528},{"id":722,"depth":214,"text":723},{"id":769,"depth":214,"text":770},{"id":920,"depth":214,"text":921},{"id":1036,"depth":214,"text":1037},"md",{},{},{"title":134,"description":200},"0wQ-PuocnKzv3uYvhcKDEFWnYTuhjaURXGfZDGqGPFE",[1076,1077],{"title":130,"path":131,"stem":132,"description":200,"children":-1},{"title":138,"path":139,"stem":140,"description":200,"children":-1},1776888559438]