CLI reference
jwks-bridge [command] [flags]. Without a command, serve runs.
serve
Runs the bridge. Flags are listed in Configuration; jwks-bridge serve -h prints them with their environment variables.
keygen
Generates a key pair and prints it as a keyset entry.
| Flag | Default | Description |
|---|---|---|
--alg | RS256 | Signing algorithm. |
--kid | UTC timestamp | Key id. |
--status | staged | staged, active or retired. Sets staged_at or promoted_at. |
--bits | 2048 | RSA key size. |
--doc | false | Wrap the entry in {"keys":[…]} for the file source. |
jwks-bridge keygen --alg ES256 --kid 2026-11-k3
jwks-bridge keygen --status active --doc > default.jsonvalidate
Validates a document or a bare array of entries, and prints the served order.
jwks-bridge validate --file default.json
vault kv get -field=keys secret/jwks-bridge/default | jwks-bridge validate--min-stage-duration applies the staging guard (default 10m).
version
Prints the version, commit and build date.