Gustavo Valverde 3390792bbe feat(oauth-provider): let private_key_jwt clients rotate their own keys ...

A confidential client with inline `jwks` can now replace its keys at
`POST /oauth2/client/rotate-keys` without a user session. The request
carries the complete new JWK Set and a client assertion signed by a
current key, addressed to the rotation endpoint itself, so an assertion
minted for the token endpoint or the issuer cannot be redirected here.
Enabled with `allowClientKeyRotation`.

Keys left out of the new set stop verifying at once. A client rolls a
key in two steps, the way a jwks_uri client does: it sends the old and
new keys together, then drops the old key once every instance signs with
the new one. Only current keys can authorize a rotation, matching
RFC 7592, node-oidc-provider, Ory Hydra, and Keycloak, where only the
current management credential can change a client.

The write is guarded on the exact key set the assertion was verified
against, so a concurrent rotation fails with 409 instead of overwriting.
No schema change is needed.

2026-10-12 14:15:06 +01:00

..

_generated/docs/v1-6

docs: add versioned documentation (#11041)

2026-08-29 07:10:36 +09:00

blogs

docs: explain the 1.7 account schema transition (#11196)

2026-09-09 10:08:03 +00:00

changelogs

…

docs

feat(oauth-provider): let private_key_jwt clients rotate their own keys

2026-10-12 14:15:06 +01:00