Struct JwksClient 

pub struct JwksClient { /* private fields */ }

JWKS client with automatic caching.

Fetches public keys from a JWKS endpoint and caches them for efficient token validation. Keys are automatically refreshed when the cache expires.

Example

let client = JwksClient::new(
    "https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com".to_string(),
    3600, // 1 hour cache TTL
);

// Get key by ID from token header
let key = client.get_key("abc123").await?;

Implementations

impl JwksClient

pub fn new(url: String, cache_ttl_secs: u64) -> Self

Create a new JWKS client.

Arguments

• url - The JWKS endpoint URL
• cache_ttl_secs - How long to cache keys (in seconds)

pub async fn get_key(&self, kid: &str) -> Result<DecodingKey, JwksError>

Get a decoding key by key ID.

This will return a cached key if available and not expired, otherwise it will fetch fresh keys from the JWKS endpoint.

pub async fn get_any_key(&self) -> Result<DecodingKey, JwksError>

Get any available key (for tokens without kid header).

Some providers don’t include a key ID in tokens. This method returns the first available key from the JWKS.

pub async fn refresh(&self) -> Result<(), JwksError>

Force refresh the key cache.

Fetches fresh keys from the JWKS endpoint regardless of cache state.

pub fn url(&self) -> &str

Get the JWKS URL.

Trait Implementations

impl Debug for JwksClient

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.