Unable to automatically download public key from JWT

JWT.io
1

Hello! Why cannot jwt.io download a public key?

When debugging, it loads https://playid.org/.well-known/openid-configuration, then https://playid.org/.well-known/jwks where the mentioned key is present. But it says “Unable to automatically download public key from JWT”.

2

Hi @hippogamesunity

Welcome to the Auth0 Community!

Thank you for bringing that to us. I’ll report that issue to our engineering team behind JWT.io and will update you as soon as I have more information.

Thanks!
Dawid

4

Hi everyone,

We are optimizing the content on our Community forum to keep information relevant, in case others encounter the same issue or behaviour.

I understand you are facing the “Unable to automatically download public key from JWT”
message when attempting to download the public key during debugging.

The Root Cause: Missing CORS Headers

The reason jwt.io cannot automatically download the public key from https://playid.org/.well-known/jwks is a Cross-Origin Resource Sharing (CORS) restriction .

When you paste a JWT into the browser-based debugger at jwt.io, the JavaScript running in your browser attempts to perform a client-side fetch (an XHR request) to retrieve your OpenID configuration and JWKS .

Because the request originates from https://jwt.io and is targeting a different domain (https://playid.org), the browser enforces CORS rules :

  1. The browser sends a request to playid.org’s endpoints .

  2. For the browser to allow jwt.io’s JavaScript to read the response, playid.org must return the following HTTP response header :

    Access-Control-Allow-Origin: *

    (Or explicitly echo Access-Control-Allow-Origin: https://jwt.io) .

If your server hosting https://playid.org/.well-known/jwks (and the OpenID configuration) does not return this header, your browser blocks the request internally for security . The network request itself may succeed with a 200 OK status when inspected directly, but jwt.io’s code is legally blind to it, resulting in the generic message: “Unable to automatically download public key from JWT” .

Recommended fix

To resolve this issue, you must configure CORS on the server or gateway hosting playid.org .

1. Enable CORS Headers on your Server

Ensure that both of your discovery endpoints return the appropriate wildcard CORS headers :

  • Endpoints requiring CORS:

    • https://playid.org/.well-known/openid-configuration

    • https://playid.org/.well-known/jwks

  • Headers to add:

    Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization

2. Handle HTTP OPTIONS (Preflight) Requests

Browsers will sometimes send an HTTP OPTIONS request (a preflight request) to check permission before fetching. Make sure your server is configured to respond to OPTIONS requests on those endpoints with a 200 OK status and the CORS headers above—without requiring authentication .

Common Pitfall: Many framework-level CORS configurations are only applied to custom API routes and silently exclude the automatic static pathing under .well-known/ . Be sure your reverse proxy (such as Nginx, Cloudflare, or an API gateway) is explicitly configured to inject these headers for the .well-known path .

Temporary Workaround for Quick Debugging

If you cannot modify the server configuration immediately, you can still verify your signatures in jwt.io:

  1. Fetch your JWKS payload directly (e.g., using curl https://playid.org/.well-known/jwks or by opening it in a new browser tab).

  2. Copy the single JSON Web Key (JWK) object from the keys array.

  3. Paste that JWK object directly into the Public Key input box in the bottom-right corner of the jwt.io debugger.

We hope this helped provide some insight!

Have a great one,
Gerald