JWK

JSON Web Key (JWK), standardized as RFC 7517, is a JSON data structure that represents a single cryptographic key, while a JWK Set (JWKS) represents a collection of them. It is part of the JOSE family of standards, and it exists to make keys portable and discoverable in the same JSON-native way APIs already move everything else. In practice, JWK is how a provider hands you the public key you need to verify a token you were just issued.

• A JSON key format - Represents RSA, elliptic-curve, and symmetric keys as plain JSON objects with well-defined members like kty, kid, use, and alg.
• JWK Sets - Bundles multiple keys into a single keys array so a service can publish and rotate several keys at once.
• A published endpoint - Providers expose a JWKS document, most often at /.well-known/jwks.json, so clients can fetch current signing keys without out-of-band coordination.
• Key rotation by kid - The key ID member lets a token reference exactly which key signed it, so issuers can roll keys without breaking verification.

In real API operations, JWK is the quiet plumbing behind token verification. When an API issues a JWT or a JWS, the receiving service fetches the issuer’s JWKS, matches the token’s kid to a key, and verifies the signature — no shared secret to distribute. This is the backbone of how OpenID Connect and OAuth 2.0 deployments hand out and rotate signing keys, and increasingly it is what lets agents and automated clients validate the tokens they carry without a human in the loop.