Hi,
when attempting to automatically download public key from JWT, jwt.io should fallback to appending .well-known path components if a request to a URL constructed by inserting fails.
From RFC 8414:
[...] However, when
deployed in legacy environments in which the OpenID Connect Discovery
1.0 transformation is already used, it may be necessary during a
transition period to publish metadata for issuer identifiers
containing a path component at both locations. During this
transition period, applications should first apply the transformation
defined in this specification and attempt to retrieve the
authorization server metadata from the resulting location; only if
the retrieval from that location fails should they fall back to
attempting to retrieve it from the alternate location obtained using
the transformation defined by OpenID Connect Discovery 1.0. This
backwards-compatible behavior should only be necessary when the well-
known URI suffix employed by the application is "openid-
configuration".