0

I am trying to validate JWT tokens for Sign in with Google. The documentation says that the Google public keys can be obtained at https://www.googleapis.com/oauth2/v3/certs. However, this address returns two keys and not one.

Why are there two keys? Do I need to try validate with one and if it does not work try the other? Or must the token be valid with both keys?

user1480192
  • 627
  • 7
  • 22
  • every key in the JWKS (JSON Web Key Set) is identified by a Key Id ("kid"). Your token should contain a "kid", which tells you which is the right key. – jps Jun 01 '22 at 19:25

0 Answers0