RemoteJwksConfig

RemoteJwksConfig

Configuration of createRemoteJwksKeyResolver.

interface RemoteJwksConfig {
	readonly url: string | URL;
	readonly transport?: JwksTransport;
	readonly headers?: Readonly<Record<string, string>>;
	readonly timeoutMs?: number;
	readonly maxResponseBytes?: number;
	readonly maxKeys?: number;
	readonly redirects?: RemoteJwksRedirectPolicy;
	readonly defaultTtlMs?: number;
	readonly maxTtlMs?: number;
	readonly cooldownMs?: number;
	readonly now?: () => number;
}

Properties

• readonly url: string | URL — The trusted JWKS URL. https, or http for a loopback host. Never taken from a token.
• readonly transport?: JwksTransport — Request transport. Default: globalThis.fetch.
• readonly headers?: Readonly<Record<string, string>> — Request headers, sent only to the configured URL's origin.
• readonly timeoutMs?: number — Whole-request deadline in milliseconds, response body included. Default 5000.
• readonly maxResponseBytes?: number — Maximum response body in bytes, enforced while streaming. Default 65536.
• readonly maxKeys?: number — Maximum keys in the set. Default 32.
• readonly redirects?: RemoteJwksRedirectPolicy — Redirect handling. Default: refuse every redirect.
• readonly defaultTtlMs?: number — Freshness applied when the response states none, in milliseconds. Default 600000.
• readonly maxTtlMs?: number — Longest freshness the resolver will keep a response for, in milliseconds. Default 86400000.
• readonly cooldownMs?: number — Minimum interval between the starts of two fetches, in milliseconds. It bounds how often unknown kid values, expired responses and failures can cause a request, and does not lengthen how long a response stays fresh. Default 30000.
• readonly now?: () => number — The clock in milliseconds since the epoch. Default Date.now.