# JWKS Published articles for JWKS. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## OpenID Connect Authentication for MySQL, Now Fully Open Source DevFeed: [OpenID Connect Authentication for MySQL, Now Fully Open Source]() Original publisher: [Read original article]() Author: Michał Jankowski Published: 2026-09-02T08:56:26Z Content type: article Language: en Sources: [Blog - Percona]() Topics: [MySQL](), [OpenID connect (OIDC)](), [Authentication](), [JSON Web Tokens](), [OAuth](), [Open Source]() Tags: [authentication](), [jwks](), [jwt](), [mysql](), [oauth](), [oauth-2-0](), [oidc](), [open-source](), [openid-connect](), [percona](), [percona-server-for-mysql](), [percona-software](), [security]() ### AI overview Percona Server for MySQL includes an open-source OpenID Connect authentication plugin for specified 8.4 and 9.7 releases. The article explains how it authenticates users through standards-compliant identity providers and describes capabilities beyond the MySQL Enterprise plugin, including JWKS signing-key synchronization, group-to-role mapping, and proxy-user support. ### Source excerpt Percona Server for MySQL now ships with a fully open source OpenID Connect (OIDC) authentication plugin, available starting with Percona Server for MySQL 8.4.11-11 and 9.7.2-2 (not yet released as of this writing). It allows a MySQL account to authenticate against any standards-compliant Identity Provider (IdP) instead of relying on a locally stored password, closing ... Continued The post OpenID Connect Authentication for MySQL, Now Fully Open Source appeared first on Percona. ## How to verify WorkOS access tokens in your own API DevFeed: [How to verify WorkOS access tokens in your own API]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-28T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [API](), [Android](), [SDKs](), [servers](), [client]() Tags: [android](), [api](), [how-to](), [http](), [jwks](), [node]() ### AI overview This tutorial explains how to verify WorkOS access tokens in a Node API, using an Android client as the example. It covers bearer-token handling, JWKS-based signature verification, claim extraction, caller identity, and distinct responses for invalid tokens, temporary verification failures, and expired tokens. ### Source excerpt Using an Android client and a Node API, including the JWKS failure mode that quietly returns the wrong status code ## Sign JWTs from your Functions without managing private keys DevFeed: [Sign JWTs from your Functions without managing private keys]() Original publisher: [Read original article]() Author: Jeff Pope Published: 2026-08-18T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [JSON Web Tokens](), [OpenID connect (OIDC)](), [JSON Schema](), [Command-line interface](), [dashboards]() Tags: [cli](), [configuration](), [jwks](), [oidc](), [openid-connect](), [rsa](), [tokens](), [vercel]() ### AI overview Vercel KMS enables Vercel Functions to sign JWTs and arbitrary messages with managed asymmetric keys, keeping private keys out of application code and environment variables. It supports issuer and key management, environment-specific access grants, claim constraints, JSON Schema validation, and standard OIDC and JWKS-based verification. ### Source excerpt Vercel KMS lets you sign JWTs and arbitrary messages from your Vercel Functions using managed asymmetric signing keys, so private keys never live in your code or environment variables. Your function authenticates with its Vercel OIDC token, and the private key stays inside Vercel's key management service while verifiers use only the public key. With Vercel KMS you can: Create and rotate issuers and signing keys (RSA, ECDSA, and EdDSA) from the CLI and dashboard. Sign JWTs with custom claims and a configurable TTL, or sign raw bytes, using the @vercel/kms package. Grant a project signing access per environment, including production, preview, development, and custom environments. Constrain the claims a project can request per grant, and validate token claims against a JSON Schema. Verify signed tokens anywhere. Each issuer publishes a public OpenID Connect Discovery document at https://kms.vercel.com//.well-known/openid-configuration and a JWK set at https://kms.vercel.com//jwks.json, so any standard OIDC or JOSE library can validate tokens without Vercel-specific code. Sign a token inside a function: Verify a token anywhere with a standard JOSE library, using the issuer's public JWKS: Set up an issuer and grant a project access from the CLI: As a best practice, create a separate issuer per project and environment. Isolating issuers keeps each token audience distinct, scopes signing access to exactly one project and environment, and lets you rotate or revoke keys for one without affecting the others. To get started, read the docs or open Key Management in your team's dashboard. Read more ## Vercel Passport is now generally available DevFeed: [Vercel Passport is now generally available]() Original publisher: [Read original article]() Author: Yanick Bélanger Published: 2026-07-31T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [Authentication](), [Entra ID](), [OpenID connect (OIDC)](), [JSON Web Tokens](), [Back end](), [Deployment]() Tags: [authentication](), [backend](), [entra-id](), [jwks](), [oidc](), [okta](), [payload](), [scope](), [vercel](), [verify]() ### AI overview Vercel Passport is generally available for protecting Vercel deployments with Okta, Microsoft Entra ID, or another OIDC provider. It provides verified visitor identity to application code, supports group-based authorization, enables token verification in downstream services, and records successful authentications in activity and audit logs. ### Source excerpt Vercel Passport is now generally available. Passport allows you to protect your Vercel deployments with your own identity provider. Visitors authenticate through Okta, Microsoft Entra ID, or any OIDC provider before viewing a protected deployment, and Vercel forwards a signed identity token to the deployment so application code can build on who the visitor is. Read visitor identity in application code The getIdentity() helper in @vercel/passport reads the Vercel request context and returns the authenticated visitor. Vercel strips client-supplied values for the x-vercel-oidc-passport-token header and injects the verified token after Passport validates the session, so the identity your code receives is already verified. The subject field is a stable identifier for the visitor, scoped to your team and the Vercel Connect application that links Passport to your identity provider, and externalSubject is the visitor's ID in the provider itself. The helper returns null only when a request arrives without a Passport session, because unauthenticated browser visitors are redirected to the identity provider before they ever reach your code. In local development, getIdentity() returns a configurable development identity, so the same code path works without a real identity provider. Authorize with groups from your identity provider The signed Passport token can now carry additional identity claims from your provider, such as group membership. Request the groups scope and allowlist the claim in the Vercel Connect application that Passport uses, then read it from the identity payload: The additional identity scopes documentation covers provider configuration, including a full Okta walkthrough. Verify identity in downstream services Forward the Passport token from your application to another backend as a bearer token and verify it there with verifyIdentity(), available in @vercel/passport 1.0.0 and later. The helper checks the token signature, the Passport claims, and that the token ## Custom OIDC Token Audiences DevFeed: [Custom OIDC Token Audiences]() Original publisher: [Read original article]() Author: Bel Curcio Published: 2026-06-23T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [OpenID connect (OIDC)](), [Vercel](), [JSON Web Tokens](), [Authentication](), [Security](), [API](), [Low Latency]() Tags: [api](), [authentication](), [jwks](), [low-latency](), [oidc](), [security](), [signing](), [tokens](), [tracing](), [vercel](), [verification]() ### AI overview Vercel now supports custom audiences for OIDC tokens. Deployments can exchange a Vercel-issued token for one targeting a specific downstream service, enabling secure service-to-service authentication with third-party providers. ### Source excerpt Vercel's OIDC issuer (oidc.vercel.com) now supports custom audiences. Deployments can request OIDC tokens with a specific audience claim, enabling secure service-to-service authentication with third-party providers. Why custom audiences? Vercel OIDC tokens are issued with a fixed audience (https://vercel.com/{owner}). While most cloud providers don't require a specific audience value, using a unique audience per provider is a security best practice. If a provider is compromised, an attacker cannot replay the token against a different provider - the mismatched aud claim will cause verification to fail. This new service makes it easy to mint provider-specific tokens without managing additional infrastructure. How it works When a Vercel deployment runs, it receives an OIDC token signed by Vercel. The new exchange service accepts this token and returns a new one signed with the same key, but with an updated audience (aud) claim targeting your downstream service. The exchanged token: Preserves all original claims (project, environment, owner, expiration) Sets the iss (issuer) to https://oidc.vercel.com/{owner}, scoped to the team that owns the deployment Includes an act (actor) claim with the original token's audience and issued-at time, providing an auditable delegation chain Updates the aud to the requested downstream audience Updates the iat (issued-at) to the current timestamp, reflecting when the new token was created You can optionally pass a jti (JWT ID) to assign a unique identifier to the exchanged token. This is useful for auditing and tracing token usage across services - for example, correlating a specific token exchange with downstream API calls in your logs. Downstream services verify the exchanged token using the public key available at https://oidc.vercel.com/{owner}/.well-known/jwks. Both the signing key and the token exchange endpoint are replicated across all Vercel regions, ensuring low-latency token exchange regardless of where the deployment is runn ## PostgREST 13 DevFeed: [PostgREST 13]() Original publisher: [Read original article]() Author: Steve Chavez; Laurence Isla; Andrew Valleteau Published: 2025-09-30T07:00:00Z Content type: article Language: en Sources: [Supabase Blog]() Topics: [API](), [Supabase](), [observability](), [JSON](), [Database](), [JSON Web Tokens]() Tags: [api](), [database](), [features](), [json](), [jwks](), [observability](), [search]() ### AI overview PostgREST 13 introduces API and observability improvements, including flattened JSON arrays for to-many relationships, automatic tsvector conversion for full-text search, limits on affected rows, Content-Length and Proxy-Status response headers, stricter JWT validation, and schema validation in the search path. ### Source excerpt New features and changes in PostgREST version 13. ## Exposing AWS KMS Asymmetric Keys as a JWKS DevFeed: [Exposing AWS KMS Asymmetric Keys as a JWKS]() Original publisher: [Read original article]() Author: Brian Maloney Published: 2023-02-02T20:53:31Z Content type: tutorial Language: en Sources: [Benchling]() Topics: [OpenID connect (OIDC)](), [Authentication](), [Authorization](), [Security](), [Amazon Web Services](), [JSON Web Tokens](), [API](), [threat detection]() Tags: [api](), [authentication](), [authorization](), [aws](), [benchling](), [encryption](), [engineering](), [enterprise](), [identity](), [jwks](), [least-privilege](), [oauth](), [oauth-2-0](), [oauth2](), [oidc](), [openid-connect](), [private-key](), [public-key](), [secrets](), [security](), [threat-detection](), [token]() ### AI overview This Benchling article discusses service-to-service authentication with OAuth 2.0 and OpenID Connect. It explains why administrator-generated API tokens create secret-management, attribution, and least-privilege problems, and introduces private_key_jwt authentication with public-key cryptography while considering AWS KMS for private-key management and JWKS exposure. ### Source excerpt Here at Benchling, interaction with services is a large part of our business, from employees interacting with the software-as-a-service products with which we conduct our daily business, all the way down to interactions between the services that make up the Benchling application platform itself. Secure authentication and authorization to services is a long-standing issue in the industry, but one that has been improving in recent years due to the widespread adoption of modern standards such as OAuth 2.0 and OpenID Connect (OIDC). One specific use case for service-to-service authentication that is important to Benchling Security is connecting our Threat Detection Pipeline to our enterprise identity services vendor. We use this connection to connect log and other data provided by the vendor to our centralized Threat Detection Platform, where we correlate this with other sources of intelligence to detect risky or suspicious user activity in near real-time. Modern Authentication with OIDC Our specific identity services vendor offers two options for authenticating to its API: either an API token that an administrator can generate, or interaction by acting as an Application. API tokens, while very easy to use, are a poor choice for two reasons: First, they are a static secret that must be handled carefully and rotated frequently to mitigate the risk of a leaked key, which causes significant management overhead. Second, the identity services vendor links the privileges and identity of an API token inextricably to the administrator who generated it. This causes actions using the key to be attributed to the administrator and also makes it impossible to implement the principle of least privilege. Client authentication when acting as an Application allows the use of OIDC, and this vendor specifically requires the use of the private_key_jwt Client Authentication method. Enforcing this requirement is a good choice on the part of the vendor -- by using public-key encryption, no sec