expertSystem Design Questions
Design a zero-downtime strategy for rotating the JWT signing key used by your Authorization Server.
Publish signing keys via a JWKS endpoint containing MULTIPLE keys, each tagged with a 'kid' (key ID). Introduce the new key alongside the old one first (both published), start signing NEW tokens with the new key while resource servers continue accepting tokens signed by either key (matched via 'kid'), and only remove the old key from JWKS once all tokens signed with it have naturally expired — avoiding any window where valid tokens are suddenly rejected.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response