Multiple Apps, Single API, mixed oauth flows

[dan.woda]

You won’t be able to user symmetric algos in a client side app. (i.e. you can’t use HS256 in a SPA).

Here is a good post that breaks it down:

JWT signing algorithms RS256 vs HS256

Both choices refer to what algorithm the identity provider uses to sign the JWT. Signing is a cryptographic operation that generates a “signature” (part of the JWT) that the recipient of the token can validate to ensure that the token has not been tampered with. RS256 (RSA Signature with SHA-256) is an asymmetric algorithm, and it uses a public/private key pair: the identity provider has a private (secret) key used to generate the signature, and the consumer of the JWT gets a public key to val…

In short: yes, you will need to use RS 256.