Interface KeyStore

Readonlyalgorithm

getSigningKidFallback

• getSigningKidFallback(): string

  Returns the current signing kid as a fallback for verifying legacy/malformed tokens that lack a kid header. Do not use for rotation-safe lookup — for rotation, pass the token's own kid to getVerificationKey(kid).

  MUST be synchronous and cheap. Remote-sign adapters (KMS/HSM) must cache the current kid locally and return it without any remote call. Never exposes private key material.

  Returns string

getVerificationKey

• getVerificationKey(kid: string): Promise<KeyLike>

  Specific kid's public key. Throws on unknown or expired kid.

  Parameters

  • kid: string

  Returns Promise<KeyLike>

getVerificationKeys

• getVerificationKeys(): Promise<ManagedKey[]>

  Active verification keys for JWKS endpoint. Remote adapters may fetch + cache.

  Returns Promise<ManagedKey[]>

sign

• sign(options: SignJwtOptions): Promise<string>

  Sign claims and return a compact JWT. The KeyStore self-injects alg and kid into the protected header; callers may set only typ. Remote-sign adapters (KMS/HSM) perform the remote call here.

  Parameters

  • options: SignJwtOptions

  Returns Promise<string>