JWKS

The mechanism that makes distributed token validation practical. The issuer publishes its public keys at a well-known URL; every resource server fetches and caches them, and validates signatures locally. No secret is shared, so a compromised resource server cannot mint tokens.

Rotation is what the design is really for. The issuer publishes the new key alongside the old, begins signing with the new one, and removes the old after every token signed with it has expired. Tokens carry a kid header naming which key signed them, so validators select correctly during the overlap.

The failure modes to design against:

Cache without refresh. A validator that caches keys indefinitely rejects everything after a rotation. A validator that fetches on every request creates a hard dependency and a load problem. Cache with a TTL, and refresh on encountering an unknown kid — with rate limiting, so an attacker cannot force unbounded fetches by sending random key IDs.

Trusting the token's own header. The alg must be pinned to what you expect. Accepting none, or allowing a downgrade to HMAC using the public key as the secret, are the classic JWT exploits and both come from trusting attacker-controlled header fields.