Service Account Token with self signed JWT #40248

Nicolfo · 2025-06-04T13:34:58Z

Nicolfo
Jun 4, 2025

I'm using the Signed JWT Authentication Method with a service account to obtain a service account token. I've configured the service to trust multiple public keys via a JWKS (JSON Web Key Set) URL. The JWKS content includes multiple keys, as shown below:

{
    "keys": [
        {
            "kty": "RSA",
            "kid": "pc-one",
            "alg": "RS256",
            "use": "sig",
            "n": "sQXLr6fLKhQW_77Y78lPUXTHGZgMfejsQcvOfQcdDEnKwI28zgOQNJJyKSxpLIxBEMJ4vdUBvW0lbbNwotwIr_aMeeg4YBQ-rymfG_CYsRj5OKFZwH35-zdtHjc4GXC6Z93L7rb9jl7aKr7b_oBgeTA_uuWqzqg74Rr6MI_ZH6oEdXrjLSTsQ9oOAgZ902v5dWVHutMo2fxwZXoduBlzfA31Q_USHrawLap5AT5KhB4tOrON6nuF5zrlVGVNxfpwoKz5bxJ6vTUTvRMuYWyKWBpPMTG0txPmt61iQwPLbgeugMI3Q1QoVhlJeWKTd_VbKjUtcSY2vJv4qkTaGgRIVQ",
            "e": "AQAB"
        },
        {
            "kty": "RSA",
            "kid": "pc-two",
            "alg": "RS256",
            "use": "sig",
            "n": "1rATxN9J-UQq2Cqb9REbhx-m-Orp_Mdn38Bl22p9KfC4fYW8AP0KJxvHgvAWAJFezzlUr1B7dnZQRiiS_mZ27_ZHGatkuo-Nnp33vfswQB4Fek_1aljuBJg9FRk9AJTCndEVi278YSVIYqcOXEK0ml899dkB_Rq96cXeseP_R3WT1J0WA6FPExYp7qvfQZ2Trv6rswq-Guh_5ffsjN-6gyUzQIzAEdaAic1PTFcFatujGmBEL_MhygShFzxhWQ9Ns99HIfnCxhSq3zhg-JIc07H3s3Lpo-TBZtzlcqbKJ3qhOPdtmjfSyToVt0GQmczj06PymbxvPavzaXch4WbY3w",
            "e": "AQAB"
        }
    ]
}

The problem is that I would like to include a reference to the key that was used to sign the JWT in the service account JWT itself (for example, adding a custom claim like "client_kid":"pc-two"). I need this behaviour because i would like to use the same client for different devices, but i want to be able to understand which device is sending the request.

Navigation Menu

Repository navigation

Service Account Token with self signed JWT #40248

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Service Account Token with self signed JWT #40248

Uh oh!

Nicolfo Jun 4, 2025

Replies: 0 comments

Nicolfo
Jun 4, 2025