kid
What this is
kid lives in the JOSE header, not the payload. When an issuer rotates keys, each JWK in the JWKS document has a kid; the token header names the one to use. Never use kid as a cryptographic input — it is a lookup hint. Reject tokens whose kid is missing from the JWKS.
FAQ
- Can kid be used to pick hmac vs rsa?
- Do not let the token choose the algorithm family. Pin the allowed algs on the verifier, then look up kid inside that family.