We have a dot.net 6 Web API Project. We validate the OKTA token by signing key, issuer, audience etc. Could you tell me How to handle the SigningKey rotation in code? We have cached the metadata retrieval for 1 day. What if we get a new signing key due to signing key rotation? Due to cache, the code will fail. Should we catch the error and refresh the cache as mentioned in the below code sample?

       configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(

          config.WellKnownEndpoint,

          new OpenIdConnectConfigurationRetriever(),

          new HttpDocumentRetriever());

      configurationManager.RefreshInterval = new TimeSpan(0, 0, 1);

      configurationManager.AutomaticRefreshInterval = new TimeSpan(1, 0, 0, 0);

    }

        var discoveryDocument = await configurationManager.GetConfigurationAsync();

        var signingKeys = discoveryDocument.SigningKeys;

        var validationParameters = new TokenValidationParameters()

        {

          ValidateIssuer = true,

          ValidateAudience = true,

          ValidateLifetime = true,

          ValidateIssuerSigningKey = true,

          RequireSignedTokens = true,

          ValidIssuer = _config.Issuer,

          ValidAudience = _config.Audience,

          ClockSkew = TimeSpan.Zero,

          IssuerSigningKeys = signingKeys,

        };

        var handler = new JwtSecurityTokenHandler();

        SecurityToken rawValidatedToken = null;

        ClaimsPrincipal principal = null;

        try

        {

          principal = handler.ValidateToken(oktaAccessToken, validationParameters, out rawValidatedToken);

        }

        catch(SecurityTokenEncryptionKeyNotFoundException)

        catch (SecurityTokenInvalidSignatureException)

        {

      configurationManager.RequestRefresh();

}