oauth_signing_keys

{“what”:“Key identifier, a short string used in JWT header ‘kid’ to select the signing key.”,“why”:“Without it, clients cannot indicate which key signed a token, breaking verification during rotation.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:40.462754343+00:00”}

{“what”:“Public key in JSON Web Key format, used to verify token signatures.”,“why”:“Without it, verifiers cannot check token signatures, so tokens become untrusted.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:40.476923968+00:00”}

{“what”:“Filesystem path to the private key used for signing tokens.”,“why”:“Without it, the signing service cannot produce signatures, so token issuance fails.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:40.492207365+00:00”}

{“what”:“JWT signing algorithm, e.g., RS256; default is RS256.”,“why”:“Without it, the algorithm for signing/verifying is ambiguous, causing interoperability issues.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:40.514534086+00:00”}

{“what”:“Timestamp when the key was created and made available for signing.”,“why”:“Without it, key rotation history is lost, making it unclear which key was active at a given time.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:40.547436045+00:00”}

{“what”:“Timestamp when the key was retired; null means still active.”,“why”:“Without it, retired keys remain usable, risking acceptance of old tokens after rotation.”,“by”:“fleet-annotator-worker”,“at”:“2026-09-22T23:55:40.568550003+00:00”}