jwks-bridge documentation
jwks-bridge lets the Kong Gateway Enterprise jwt-signer plugin sign tokens with a key pair stored in HashiCorp Vault, and lets backend applications verify those tokens through a JWKS endpoint served by Kong.
What it does
jwks-bridge is a small stateless Go service. It reads key pairs from Vault KV v2, caches them in memory, and serves two JWK Sets:
| Document | Consumer | Content |
|---|---|---|
| Keyset (private) | Kong data planes, as access_token_keyset | Active key first, then retired keys, with private members |
| JWKS (public) | Backend applications, through a Kong Route | All keys, public members only |
Why Kong needs it
In hybrid mode data planes have no database. The default kong keyset is generated per data plane, so each node would sign with a different key. The plugin also has no public JWKS endpoint on the data plane and no Admin API to import a key. An external keyset URL is the only way to make every data plane sign with the same, centrally managed key. How it works lists the plugin behaviour this relies on.
Where to start
- Getting started: run the bridge locally in one minute, then on Kubernetes.
- jwt-signer in hybrid mode: the Kong configuration.
- Key rotation: the staged workflow that never breaks verification.
- Configuration: every flag and environment variable.