Node.js JWKS Endpoint with Crypto: Adding Missing Metadata

Developers building an OAuth 2.0 or OpenID Connect provider in Node.js can generate key pairs and export them as JSON Web Keys with the built-in crypto module: call publicKey.export({ format: 'jwk' }), wire up a JWKS endpoint, and let resource servers verify tokens. The export contains only the key material (kty plus n and e for RSA, or crv, x and y for EC). It leaves out alg, use and kid. RFC 7517 marks all three as optional, and we tested that a single bare key still verifies with current jose and jwks-rsa. The metadata matters once you publish more than one key, which is what key rotation requires: without a kid, verifiers cannot tell which key signed a token. This article builds a /.well-known/jwks.json endpoint using only Node.js's native crypto module and Express, covering key generation, metadata enrichment, RFC 7638 thumbprint derivation, and end-to-end verification.

Prerequisites: a current Node.js LTS release (the code here was tested on Node.js 22), basic familiarity with Express, and an understanding of asymmetric key concepts such as public/private key pairs and digital signatures. The jose verification example uses ES module syntax, so it needs "type": "module" in package.json or a .mjs file extension. Updated October 2026: code tested against Express 4, jose 6.2.12 and jwks-rsa 4.1.0.