Faactory.Jwks 0.1.3

JWKS retrieval

A minimal .NET library for retrieving and caching JSON Web Key Sets (JWKS) for JWT validation.

Designed for services that need reliable, in-memory access to signing keys with automatic refresh.

Features

• Fetch JWKS from HTTP(S) or local sources
• In-memory caching with periodic refresh
• Optional local file support for development
• Resilient HTTP handling (retries, circuit breaker, timeout)

Installation

Install the package from NuGet:

dotnet add package Faactory.Jwks

Usage

Register the JWKS provider in your service collection:

builder.Services.AddJwksProvider( options =>
{
    options.Uri = "https://example.com/jwks.json";
    options.RefreshInterval = TimeSpan.FromMinutes( 30 );
} );

ASP.NET Core Integration

If you're using ASP.NET Core with JWT bearer authentication, you can integrate the JWKS provider directly into token validation.

First, install the integration package:

dotnet add package Faactory.Jwks.AspNetCore

Then register the JWKS provider (same as before) and enable token validation integration:

builder.Services.AddJwksProvider( options =>
{
    options.Uri = "https://example.com/jwks.json";
    options.RefreshInterval = TimeSpan.FromMinutes( 30 );
} );

builder.Services.AddJwksTokenValidation();

This configures JWT bearer authentication to resolve signing keys using the registered JWKS.

Optional: Distributed Cache

If a distributed cache (IDistributedCache) is registered, the provider will:

• load the last known JWKS on startup (if available)
• persist refreshed JWKS to the cache

This can help reduce downtime during application restarts if the JWKS endpoint is temporarily unavailable.

No additional configuration is required beyond registering a distributed cache implementation.

Local Development

You can use a local JWKS file instead of an HTTP endpoint:

    builder.Services.AddJwksProvider( options =>
    {
        options.Uri = "/path/to/local/jwks.json";
    } );

Relative paths and ~/ are also supported.

When to Use

Use this library if:

• you validate JWTs
• you rely on a JWKS endpoint
• you want caching and refresh handled for you