JWTs and JWKS
AIGW exposes two distinct issuer/key contexts. This distinction is one of the most important implementation details in the supplied environment.
1. Agent-facing AIGW tokens
The per-resource discovery document reports the global/core issuer and core JWKSJWKSJSON Web Key Set: a published set of public keys used to verify JWT signatures.. AIGW access tokensAIGW access tokenThe token an agent receives after the user authorizes it. It says which user approved which agent for which scopes. issued to agents come from this core context.
Issuer: https://core.api.aigw.eval.loginid.ai/
JWKS: https://core.api.aigw.eval.loginid.ai/.well-known/jwks.json
The supplied notes observed core-issued JWTs using RS256.
2. Merchant-facing Resource assertions
AIGW signs user assertions and client assertions with the ResourceResourceThe downstream system registered in a Project. Its kind (Token exchange or OAuth client) decides the role AIGW plays.'s ES256 key.
Issuer: https://api.aigw.eval.loginid.ai/<RESOURCE_ID>
JWKS: https://api.aigw.eval.loginid.ai/<RESOURCE_ID>/.well-known/jwks.json
Alg: ES256
These are the values the merchant authorization server trusts.
User assertion claims
| Claim | Value |
|---|---|
iss | per-resource AIGW issuer |
sub | external reference candidate |
aud | configured merchant issuer URL |
iat / exp | assertion validity window |
jti | unique ID |
Client assertion claims
| Claim | Value |
|---|---|
iss | merchant-AS client ID |
sub | merchant-AS client ID |
aud | configured merchant issuer URL |
iat / exp | same configured assertion lifetime |
jti | unique ID |
Rotation
Resource JWKS can contain older, non-active keys as well as the active key. Merchant verifiers should select by kid and refresh JWKS when encountering an unknown key.