Right now, you can use a single JWT public key to validate access tokens, which is an improvement over plain credentials already. What would be even better (and aligned with web standards), would be support for JSON Web Key Sets (JWKS).
Such a key set is an array of public keys used to issue tokens; on its own, that allows rotating the public keys already. More importantly though, the JWKS is usually available on a public URL, which in turn can be located using the jwks_uri property returned by the standardised OpenID Discovery Endpoint (specified as {host}/.well-known/openid-configuration.)
In practice, this means users could configure their authorization server host or discovery URL, the service retrieves (and caches) the metadata document from the endpoint, reads the JWKS URI from the response, retrieves (and caches) the public keys from this URI, and validates tokens against each key in the set.
JWKS and OpenID Discovery is supported by all major authentication providers and client libraries, so this would enable a lot of people to configure the URL once, and don't have to worry about key rotations and expiration anymore.
Right now, you can use a single JWT public key to validate access tokens, which is an improvement over plain credentials already. What would be even better (and aligned with web standards), would be support for JSON Web Key Sets (JWKS).
Such a key set is an array of public keys used to issue tokens; on its own, that allows rotating the public keys already. More importantly though, the JWKS is usually available on a public URL, which in turn can be located using the
jwks_uriproperty returned by the standardised OpenID Discovery Endpoint (specified as{host}/.well-known/openid-configuration.)In practice, this means users could configure their authorization server host or discovery URL, the service retrieves (and caches) the metadata document from the endpoint, reads the JWKS URI from the response, retrieves (and caches) the public keys from this URI, and validates tokens against each key in the set.
JWKS and OpenID Discovery is supported by all major authentication providers and client libraries, so this would enable a lot of people to configure the URL once, and don't have to worry about key rotations and expiration anymore.