# Br Jwks Jwt Auth

> Configure better-route 0.6.0 RS256/ES256 JWT verification from JWKS. Use when adding Rs256JwksJwtVerifier, JwksProviderInterface, HttpJwksProvider, StaticJwksProvider, JwtBearerTokenVerifierAdapter, strict JOSE kid matching, issuer/audience checks, JWKS transient cache, better_route/jwks_refresh, or OIDC/OAuth bearer token verification. Rejects none and HS* algorithms. Updated 2026-05-02.

- **Type:** Skill
- **Install:** `agentstack add skill-lonsdale201-wp-agent-skills-br-jwks-jwt-auth`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Lonsdale201](https://agentstack.voostack.com/s/lonsdale201)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Lonsdale201](https://github.com/Lonsdale201)
- **Source:** https://github.com/Lonsdale201/wp-agent-skills/tree/main/better-route/br-jwks-jwt-auth

## Install

```sh
agentstack add skill-lonsdale201-wp-agent-skills-br-jwks-jwt-auth
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# better-route: JWKS JWT auth

Use this for OIDC/OAuth-style bearer JWTs signed with asymmetric keys. In better-route 0.6.0 the library ships `Rs256JwksJwtVerifier`, so do not write a custom verifier for normal `RS256` or `ES256` JWKS use cases.

## Pattern

```php
use BetterRoute\Middleware\Auth\BearerTokenAuthMiddleware;
use BetterRoute\Middleware\Auth\JwtBearerTokenVerifierAdapter;
use BetterRoute\Middleware\Jwt\HttpJwksProvider;
use BetterRoute\Middleware\Jwt\Rs256JwksJwtVerifier;

$jwks = new HttpJwksProvider(
    jwksUri: 'https://issuer.example.com/.well-known/jwks.json',
    ttlSeconds: 3600,
    issuer: 'https://issuer.example.com'
);

$verifier = new Rs256JwksJwtVerifier(
    jwks: $jwks,
    leewaySeconds: 60,
    expectedIssuer: 'https://issuer.example.com',
    expectedAudience: 'my-api',
    requireExpiration: true,
    maxLifetimeSeconds: 3600,
    allowedAlgorithms: ['RS256']
);

$auth = new BearerTokenAuthMiddleware(
    verifier: new JwtBearerTokenVerifierAdapter($verifier),
    requiredScopes: ['orders:read']
);
```

For write routes, still call `->protectedByMiddleware('bearerAuth')` so WordPress dispatches to the middleware pipeline.

## Critical rules

- `kid` in the JOSE header is required and must match exactly one usable JWKS key.
- On `kid` miss, the verifier calls `JwksProviderInterface::refresh()` once, then fails closed.
- Never fall back to "try every public key"; that accepts stale or unrelated keys.
- `allowedAlgorithms` supports `RS256` and `ES256`; `none` and `HS*` are rejected even if accidentally configured.
- `HttpJwksProvider` requires an `https` URI and uses `sslverify => true`.
- Private JWK fields are stripped by `JwksKeySanitizer`; JWKS should contain public keys only.
- Set `expectedIssuer` and `expectedAudience` in production.
- Keep `requireExpiration: true`; disabling it is a migration-only decision.

## JWKS cache invalidation

`HttpJwksProvider` listens for:

```php
do_action('better_route/jwks_refresh', 'https://issuer.example.com');
```

Use this from admin tooling after key rotation or when forcing a cache clear.

## Tests

Use `StaticJwksProvider` for unit tests:

```php
$verifier = new Rs256JwksJwtVerifier(
    new StaticJwksProvider([$publicJwk]),
    now: static fn (): int => 1700000000
);
```

## Cross-references

- Use `br-auth-middleware` for generic auth middleware choice and `protectedByMiddleware()` route intent.
- Use `br-error-contract` for the `401 invalid_token` response shape.
- Use `br-crypto` when generating nonces, state, PKCE values, or doing token-bound string compares.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Lonsdale201](https://github.com/Lonsdale201)
- **Source:** [Lonsdale201/wp-agent-skills](https://github.com/Lonsdale201/wp-agent-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-lonsdale201-wp-agent-skills-br-jwks-jwt-auth
- Seller: https://agentstack.voostack.com/s/lonsdale201
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.