I have a clarification question. If our jwks endpoint will returns the list of public keys, tell me if my prediction wrong. To validate the request, you will do something

for public_key in public_keys_array
    if validate_request(request, public_key) {
        return true
    }
}

you go through each public key and validate whether the request was signed by this public key. The process will fail only there is no public key to validate the request?

Hi @yury.starav - yes, that is correct. You can see the Medplum implementation here: https://github.com/medplum/medplum/blob/main/packages/server/src/oauth/token.ts#L307-L366 You will see that the complexity "verifying a JWT with a JWKS" is managed by a 3rd party method called

jwtVerify

from the

jose

library: https://github.com/panva/jose/blob/main/docs/functions/jwks_remote.createRemoteJWKSet.md#readme

"aud": "https://api.medplum.com/oauth2/token", do you accept the aud parameter like this?

yes, i believe that should be correct