Let me address your question about using http.send for JWT validation with JWKs endpoints. The documentation shows that JWKs are a standardized format for representing cryptographic keys using JSON, playing a crucial role in securing web applications and APIs that utilize JWTs for authentication and authorization (1) . When working with JWKs, you typically need to retrieve them from an endpoint to verify JWT signatures . For JWT validation, the common approach involves: • Retrieving JWKS via an endpoint that contains the jwks_uri key • Using the kid (key identifier) from your JWT header to match with the corresponding identifier in the JWKS The documentation provides examples of JWKS endpoints for various authentication providers : • Auth0:

https://{yourDomain}/.well-known/jwks.json

• AWS Cognito:

<https://cognito-idp>.<Region>.<http://amazonaws.com/<userPoolId>/.well-known/jwks.json|amazonaws.com/<userPoolId>/.well-known/jwks.json>

• Clerk.com:

https://<YOUR_FRONTEND_API>/.well-known/jwks.json

Regarding your concern about http.send and production use, while the sources don't specifically address the "not recommended for production" aspect of http.send in the context of JWKs validation, they do emphasize that JWTs themselves aren't made for authorization - they're made for verification, exchanging tokens, and token-based authentication (2) . The proper approach is to use JWTs as a source of truth for user identity to query an external authorization service . For production JWT validation in Permit.io's ecosystem, the documentation shows integration with established authentication providers and their JWKS endpoints (1) , suggesting this is indeed a valid use case where external HTTP calls to retrieve signing keys are necessary and expected.

To learn more, see the sources I considered: [[1] JWK, JWKS and how to obtain them](https://docs.permit.io/foaz/fetching-jwks) [[2] JWTs Aren’t Made for Authorization](https://www.permit.io/blog/jwts-arent-made-for-authorization)