Is the endpoint to get the JWK for token validation rate limited?

[a.saad]

Hello,

I have a backend service that needs to validate tokens. I read this guide and it mentions that I should hit the endpoint:

https://your-tenant.auth0.com/.well-known/jwks.json

in order to retrieve the public key. What the article didn’t mention though was whether the endpoint is subject to rate limits or not.

So if I have a medium-sized application, ~30K active users, will it be ok to get the JWK from the endpoint each time I want to validate a token or should I cache it? And if I’m supposed to cache the key, how often should I refresh my cache?

Thanks

[tyf]

Hey there @a.saad welcome to the community!

@a.saad

in order to retrieve the public key. What the article didn’t mention though was whether the endpoint is subject to rate limits or not.

So if I have a medium-sized application, ~30K active users, will it be ok to get the JWK from the endpoint each time I want to validate a token or should I cash it? And if I’m supposed to cash the key, how often should I refresh my cash?

The /jwks endpoint is indeed subject to rate limits, so you’ll definitely want to implement some sort of caching. It really depends on your application needs and whether or not you have signing key rotation enabled (you should ) You can see how Auth0 goes about this in our node-jwks-rsa library. The following resources should be of help as well:

Token Best Practices

Caching JWKS signing key

Hi @benji. (This response was updated on April 2021 to reflect signing keys rotation and updated guidance on caching). Auth0 nows support signing key rotation initiated by tenant admins (see Signing Keys for details). A tenant’s JWKS resource will have the current key and the “next” key, so applications that prepare in advance for a key rotation. The JWKS resource will return the same set of keys most of the time. Applications should cache these resources, but they also need to be prepared to…

Hope this helps!