Skip to main content

OIDC and OAuth configurations and certificates

The OIDC and OAuth JWKS files define the public signing key. The same key signs the ID token, user info data (available from the issued access token), and the JWT access token.

Use these configurations and keys to validate tokens issued by IDaaS and to configure your OIDC/OAuth client correctly.

Obtain the JWKS file​

  1. Click > Security > Applications. The Applications List page appears.
  2. Under OpenID Connect and OAuth Cloud Integrations, click the following, as required:
    • OIDC Configuration to view or copy the OIDC JWKS and OIDC configuration metadata.
    • OAuth Configuration to view or copy the OAuth JWKS and OAuth configuration metadata.
  3. Click OK to close the configuration dialog box.
note

If token validation fails because of an unknown key ID (kid), refresh your cached JWKS and retry validation.

Validate token configuration​

When you validate tokens in your application or API gateway, verify the following:

  • The token issuer (iss) matches your IDaaS issuer value.
  • The token audience (aud) matches your client application or API value.
  • The token expiration (exp) is still valid.
  • The token signature is verified using the current JWKS public key.
tip

Most signature validation failures are caused by stale JWKS caches or issuer mismatches.