JWK (JSON Web Key, RFC 7517) is a JSON object representing a cryptographic key. Together with JWK Set (a collection of JWKs), it’s the standard way an OAuth provider publishes the public keys needed to verify its signed JWTs.
JWK Format
{
"kty": "RSA",
"kid": "2020-12-08",
"use": "sig",
"alg": "RS256",
"n": "0vx7agoebGcQSuuPiLJXZptN9nndrQ...",
"e": "AQAB"
}Common Fields
| Field | Purpose |
|---|---|
kty | Key type — RSA, EC, OKP, oct |
kid | Key ID — matched to a JWT header’s kid for key selection |
use | sig for signing / enc for encryption |
alg | Algorithm — RS256, ES256, EdDSA, etc. |
n / e | RSA modulus + exponent |
crv / x / y | EC curve + public coordinates |
JWK Set (JWKS)
A JWKS is a URL served by an OAuth issuer listing all their current signing keys as a JWK array. Standard location: https://issuer/.well-known/jwks.json.
When verifying a JWT, the receiver:
- Reads the JWT header’s
kid - Fetches the issuer’s JWKS
- Finds the JWK matching
kid - Uses that key to verify the signature
Rotation
Publish new keys in the JWKS a few days before you start signing with them. Retire old keys by removing them from the JWKS after issued tokens expire.
Decode a JWT and see which kid it references with the JWT decoder.
Related
Check the JWT glossary entry, the JWS glossary entry, and read the What Is a JWT? deep dive.