Understanding Signing Key Configurations and Shadow Keys in FusionAuth JWTs
The forum post discusses how FusionAuth handles JWT signing key configurations, including the use of primary signing keys and shadow keys to enable seamless key rotation without invalidating existing tokens.
Background
- FusionAuth is an open-source identity and access management (IAM) platform that handles user login, registration, and security for applications, similar to Auth0 or Okta but self-hostable.
- JWTs (JSON Web Tokens) are a standard way to pass user identity data between systems. They are digitally signed so the receiver can verify they haven't been tampered with.
- A "signing key" is the cryptographic secret used to create that digital signature. If you rotate (change) keys, old JWTs signed with the previous key become invalid, which can break user sessions during a transition.
- "Shadow keys" are a FusionAuth feature: they let the system accept JWTs signed with the old key while new tokens are signed with the new key. This enables zero-downtime key rotation — old tokens stay valid until they expire naturally, avoiding forced logouts.