FHm can you share where you see that?
Self-hosted or cloud?
You can share me the domain in a DM if you use our cloud service
Self-hosted or cloud?
You can share me the domain in a DM if you use our cloud service
F@johakoch can it be that your instance was not being used (logins) for more then 30h?
FOk, so it could well be that no new keys were generated because nobody did login and the old public keys expired after 30h
Fyes, atm that is true
Fwe are currently working on that improvement of the key managemnt, but will take us a moment to finish
Fhei @fuzzbizz as mentioned in the github discussion, we have released the new management in an alpha state and would like to get some feedback, you can find the docs here: https://zitadel.com/docs/guides/integrate/login/oidc/webkeys
FI do not understand what you are trying to achieve, can you elaborate?
The client can cache the jwks with a scheduled approach but it needs to fetch new keys once it encounters tokens with an unknown
Btw. we have an alpha version of an api that allows you to rotate the keys yourself https://zitadel.com/docs/category/apis/resources/webkey_service_v3/zitadel-web-keys
The client can cache the jwks with a scheduled approach but it needs to fetch new keys once it encounters tokens with an unknown
kidBtw. we have an alpha version of an api that allows you to rotate the keys yourself https://zitadel.com/docs/category/apis/resources/webkey_service_v3/zitadel-web-keys
FAh I see, yeah then I would look into the new api since it allows you to change/activate keys at your choice
FI see, that happens if nobody logs in for a few hours, then zitadel stops creating new keys
FBut the new API does solve that for you
FWell that would work to my take... when self-hosting you could also change the rotation times.
But to me the api call to the new jwks api is easier then doing a workaround with a user login
But to me the api call to the new jwks api is easier then doing a workaround with a user login
FThe way forward for us will be to switch to "static" keys that a customer can create/activate through an api.
FReason is that many tools anyway have a lot of problems with automatically rotating keys and we want to fix that in general
FYou can find more insights here https://github.com/zitadel/zitadel/discussions/7464
FCreating a new key is not super expensive, we currently even roll new once for active instances each 6h as default 