This is a contributors guide and NOT a user guide. Please visit these docs if you are using or evaluating SuperTokens.
We should use the same keys to sign access tokens and custom JWTs
This is just a proposal so far, it hasn't been accepted and needs further discussion.
- rishabhpoddar, porcellus
- Proposed by:
#Context and Problem Statement
Since our access tokens will be standard JWTs and we want to enable their verification without our SDK, we will expose the public keys using a jwks endpoint. These can be the same as the keys we use to sign other (custom) JWTs.
- Separate keysets exposed under separate endpoint
- Separate keysets exposed under a single endpoint
- Same keyset
We should use the same keyset to sign access tokens and custom JWTs:
- Having separate endpoints could be confusing to users
- Having separate settings for the two keysets could be confusing if we expose them under the same endpoint
- Exposing the union of the two keysets under the same endpoint could cause (minor) problems when caching keys for verification
- Check this decision for discussion on static and dynamic keys.