Best Practices for Caching the Okta JSON Web Keys Set(JWKS) for OAuth
Last Updated:
Overview
Caching the JSON Web Key Set (JWKS) that the jwks_uri endpoint returns limits the number of calls and potential latency when tokens require local validation. To save network round trips and avoid verification failures during automatic key rotation, cache the jwks_uri response locally based on the directives in the standard HTTP Cache-Control headers.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- OpenID Connect (OIDC) / OAuth 2.0 applications
- API Access Management
- JSON Web Key Set (JWKS) endpoint
Solution
What are the best practices for caching the Okta JSON Web Key Set?
When an authorization server automatically rotates key credentials, dynamically fetch and cache the public keys from the JWKS endpoint to verify token signatures. To avoid verification failures during automatic key rotation, cache the keys that the jwks_uri returns based on the directives in the standard HTTP Cache-Control headers that the response includes. This directive indicates the safe duration to cache the keys. If the directive is no-cache, do not cache the keys, as Okta will rotate them soon.
