A JSON Web Key Set is a JSON document listing public keys, served at a URL. In LTI® 1.3 both sides publish one: the platform so tools can verify the ID Token, and the tool so the platform can verify its service calls.
Each key carries a kid. A signed message names the kid it used in its header, and the verifier looks that key up in the set.
Publishing a key set rather than exchanging a secret is what lets either side rotate keys without the other having to do anything.
All trademarks, logos, and service marks displayed on this website are the property of their respective owners. LTIAAS is a trademark of GatherAct, LLC, doing business as LTIAAS. Learning Tools Interoperability (LTI)® and LTI® are trademarks of 1EdTech Consortium, Inc. LTIAAS is not affiliated with, endorsed or sponsored by 1EdTech Consortium, Inc. or by any other owners of third-party trademarks used on this website. LTIAAS is not responsible for the content, quality, or accuracy of any websites linked to or from this website that are not owned by LTIAAS. If you have any questions or concerns about the use of any trademarks or content on this website, please contact us.
