JSON Web Key (JWK)

A JSON Web Key (JWK) is a cryptographic key written as JSON text, used to sign and verify JWTs and other JOSE-based tokens.

A JSON Web Key (JWK) is a JSON object that represents a cryptographic key: its type, its value and how it may be used. Instead of a binary key file, the key travels as ordinary JSON text - the same format used by JSON Web Signature (JWS), JSON Web Encryption (JWE) and the rest of the JOSE family, so a system that already parses JSON can read a key without a separate library for a binary certificate format such as X.509.

A JWK carries a small set of standard members alongside the key material itself:

• kty (key type): the cryptographic family - RSA, EC (elliptic curve) or oct (a symmetric key)
• use or key_ops: the intended purpose, such as signing ("sig") or encryption ("enc"), or a finer list of operations like sign, verify, encrypt or decrypt
• alg: the specific algorithm the key is meant to be used with, as named in JSON Web Algorithms (JWA)
• kid (key ID): a label that lets a header such as a JWS header point to the right key when several are available

Multiple keys are usually published together as a JWK Set: a JSON object with a single keys member holding an array of JWKs. This is how an identity provider or wallet provider commonly exposes its current public keys at a jwks_uri, so that a relying party verifying a JSON Web Token (JWT) can look up the matching public key by its kid without the two parties exchanging keys out of band.

Note: a JWK can hold a private key as well as a public one. Publishing a JWK Set at a public URL is safe only because it is meant to contain public keys - a private JWK belongs in a protected store, never on a public endpoint.