platxa-jwt-auth

RS256 JWT authentication with a JWKS endpoint is generated by creating secure token infrastructure for access, editor, and service tokens. This setup includes database schema for key management and supports configurable expiry times for Platxa services.

Key rotation for JWT verification updates signing keys automatically while maintaining a 24-hour grace period. This allows seamless key transitions without invalidating active tokens during the rotation process across the JWKS endpoint.

Yes, service-to-service tokens with custom expiry times are fully supported. The infrastructure generates RS256 tokens specifically for service communication alongside access and editor tokens, all with configurable expiration durations.

A database is required for JWKS key management because the generated infrastructure includes a specific database schema for key storage. This schema handles the persistence and rotation logic needed for secure key updates.

Access tokens authenticate general user requests, editor tokens grant elevated modification privileges, and service tokens handle secure service-to-service communication. All three token types are generated using RS256 signing and managed through the JWKS endpoint.

Exposing public keys through a JWKS endpoint instead of hardcoding them enables automated key rotation and dynamic discovery. This allows verifying services to fetch updated public keys securely without manual redeployment.