Hi - I got a question :) I’m currently fetching your JWKS endpoint every 5 minutes in order to cache the keys for token verification and I want to build a condition to verify the JWKS response was valid before caching it. Any tips on how to do that? anything else i should do beside verifying the 200 status? Thanks!

Hi, I'm Descope's AI assistant. I've put together an initial response below based on your question. Here are the key checks you should perform on a JWKS response beyond just the HTTP status code, based on Descope's JWKS structure and general best practices for robust key caching: 1. Validate the Response Content-Type Ensure the response has

Content-Type: application/json

. A

200

with an HTML error page or an empty body should be rejected immediately. 2. Verify the Response is Valid JSON Parse the body and confirm it deserializes without errors before doing anything else with it. 3. Check the

keys

Array Exists and is Non-Empty The JWKS response must contain a

keys

field that is a non-empty array. A response like

{"keys":[]}

is structurally valid JSON but functionally useless — caching it would break all token verification.

{
  "keys": [ { "kty": "RSA", "kid": "...", ... } ]
}

Reject and retain your previous cache if

keys

is missing or empty. 4. Validate Required Fields on Each Key Object For Descope, keys use

RS256

, so each key object should have: •

kty

— must be

"RSA"

•

use

— typically

"sig"

(signing key) For further details, you can refer to the following resources: • OIDC Endpoints Quickstart | Descope Documentation • Secure API Calling With Custom GPTs and Descope • Authenticating APIs With JWT Authorizers and OIDC