jwks_client_rs

jwks_client_rs is a Rust library for working with JSON Web Key Sets (JWKS) from an authentication provider such as Auth0. It fetches a provider’s JWKS, stores the keys in an internal cache, and automatically refreshes them after a configurable interval, so your application always has current signing keys without managing that lifecycle itself.

Beyond key retrieval, it can decode and validate JWTs by verifying that a token was signed by one of the provider’s published keys, returning strongly typed claims. The key source is pluggable via a trait, with a built-in HTTP WebSource built on reqwest for the common case.

What You Get

• An async JwksClient that fetches and caches JWKS by key id (kid)
• Automatic background refresh of keys after a configurable duration
• JWT decoding and signature validation against the cached key set with typed claims
• A pluggable JwksSource trait with a ready-made HTTP WebSource built on reqwest
• Builder-style configuration for timeouts, connect timeouts, and the key source

Common Use Cases

• Validating access tokens issued by Auth0 or another OIDC provider in a Rust API
• Caching provider signing keys to avoid a network round-trip on every request
• Automatically rotating to new signing keys as the provider publishes them
• Decoding JWT claims into typed structs after verifying the signature

Under The Hood

Architecture - The crate is organized around JwksClient (client.rs), which wraps a JwksSource and an internal cache (cache.rs) keyed by kid. A KeySet (keyset.rs) models the fetched keys, source.rs defines the JwksSource trait plus the reqwest-backed WebSource, and builder.rs exposes fluent builders for both the client and the source. Lookups return cached keys or trigger a refresh, and token validation delegates signature checking to jsonwebtoken. Tech Stack - Rust (edition targeting rustc 1.88), with tokio for async synchronization, reqwest for HTTP, jsonwebtoken for JWT verification, chrono for refresh timing, and serde for claim deserialization. Code Quality - Sources are split cleanly by concern (client, cache, source, keyset, builder, error), there is a dedicated error.rs for a typed JwksClientError, and an examples/ directory demonstrates usage; the project maintains a CHANGELOG and is actively developed by Prima. API Design - The builder pattern keeps setup readable, and the primary surface is small — build a source, build a client, then get(kid).await or decode a token. The JwksSource trait makes the fetch strategy swappable (e.g. for tests or non-HTTP sources), keeping the ergonomics high.