Fetch a JWKS from your identity provider
Find the JSON Web Key Set (JWKS) of your identity provider, so you can add the JWKS to your Permit environment. This page is for developers who let a frontend authenticate to Permit with the JSON Web Tokens (JWTs) their identity provider issues, for example for Permit Elements. After you have the JWKS, configure it in Permit.
What are JWKS?
A JSON Web Key (JWK) is a JSON object that represents a cryptographic key. Identity providers sign JWTs with a private key and publish the matching public keys as JWKs. A service that receives a JWT uses the public key to verify the JWT signature. The format is defined in RFC 7517.
JWK vs. JWKS
| Item | Description |
|---|---|
| JSON Web Key (JWK) | A JSON object that represents one cryptographic key. The members of the object are properties of the key, including its value. |
| JSON Web Key Set (JWKS) | A JSON object that represents a set of JWKs. The object must have a keys member, which is an array of JWKs. |
Find the JWKS URL of an identity provider
Identity providers publish a JWKS in one of two ways:
- Through OpenID Connect discovery. Request the provider's discovery document, usually
https://<your-domain>/.well-known/openid-configuration. Thejwks_urivalue in the response is the URL of the JWKS. - At a documented JWKS URL. Some providers publish the JWKS at a fixed URL. See JWKS URLs of common identity providers.
Open the JWKS URL in a browser or request it with curl. The response is a JSON object with a keys array.
Find the key that signs your JWT
A JWKS can contain several keys, for example while a provider rotates signing keys. To find the key that signs your JWTs:
- Decode one of your JWTs, for example with jwt.io.
- Copy the
kid(key ID) value from the JWT header. - Find the key in the JWKS
keysarray with the samekid.
JWKS URLs of common identity providers
Identity providers change their URLs and dashboards. If a URL in this section doesn't return a JWKS, check the linked provider documentation.
Auth0
Auth0 publishes a JWKS for each tenant at https://{yourDomain}/.well-known/jwks.json. Auth0 signs tokens with one key at a time, but the JWKS can contain several keys while you rotate signing keys. See Auth0 JSON Web Key Sets.
Okta
Okta signs JWTs with RS256 and publishes the public signing keys in a JWKS, listed in the jwks_uri of the OAuth 2.0 and OpenID Connect discovery documents. Okta rotates signing keys regularly, so fetch the current keys instead of copying one key. See Okta: validate access tokens.
AWS Cognito
Each Cognito user pool publishes a JWKS at https://cognito-idp.<Region>.amazonaws.com/<userPoolId>/.well-known/jwks.json. Replace <Region> and <userPoolId> with the values of your user pool. See Verifying a JSON Web Token in Amazon Cognito.
Clerk
Clerk publishes the JWKS of an instance in two places:
- The Frontend API:
https://<YOUR_FRONTEND_API>/.well-known/jwks.json - The Backend API:
https://api.clerk.com/v1/jwks
See Clerk manual JWT verification.
OneLogin
OneLogin publishes the public OpenID Connect signing keys at https://<subdomain>.onelogin.com/oidc/2/certs. When you create several signing keys, only the most recently created key is active. The other keys are in a draining state, and OneLogin issues no new tokens with them. See OneLogin: list keys.
SuperTokens
SuperTokens serves the JWKS from your API server at <apiDomain><apiBasePath>/jwt/jwks.json, where apiDomain and apiBasePath are the values you set when you initialize the SuperTokens backend SDK. With the default base path, the URL is <apiDomain>/auth/jwt/jwks.json. See SuperTokens: protect API routes.