Key Rotation with kid

You should rotate signing keys regularly (compromise mitigation, compliance). But you can't INSTANTLY swap — existing valid tokens were signed with the old key.

The kid (key ID) header field lets multiple keys coexist:

header: {"alg":"RS256","kid":"k1","typ":"JWT"}

The verifier looks up the key by kid:

Rotation:

1. Add new key k2 to keys dict; KEEP old key k1.
2. Start signing new tokens with k2.
3. Wait for all k1-signed tokens to expire.
4. Remove k1.

Standard endpoint: /.well-known/jwks.json returns all current public keys. Auth0, Okta, Google all expose this. Your server fetches the JWKS, caches it, refreshes on kid miss.

NEVER trust alg from the header alone — pin the expected algorithm per key. The infamous "alg=none" attack: attacker swaps alg:HS256 for alg:none, removes signature. Naive verifiers accept it.