How to verify a JWT with a JWKS in C#

1#:package Microsoft.IdentityModel.JsonWebTokens@8.23.0
2using Microsoft.IdentityModel.JsonWebTokens;
3using Microsoft.IdentityModel.Tokens;
4 
5// Fetch the issuer's key set once (cache it; refetch on a schedule or on an unknown kid)
6using var http = new HttpClient();
7var jwks = new JsonWebKeySet(await http.GetStringAsync("https://issuer.example.com/.well-known/jwks.json"));
8 
9var parameters = new TokenValidationParameters
10{
11    ValidIssuer = "https://issuer.example.com",
12    ValidAudience = "api://orders",
13    IssuerSigningKeys = jwks.GetSigningKeys(), // the handler picks the one whose kid matches
14    ValidAlgorithms = ["ES256"],               // never let the token choose the algorithm
15    RequireExpirationTime = true,
16};
17var handler = new JsonWebTokenHandler();
18 
19foreach (var line in File.ReadLines("tokens.txt"))
20{
21    if (line.Split(' ') is not [var label, var token]) continue;
22    TokenValidationResult result = await handler.ValidateTokenAsync(token, parameters); // returns, does not throw
23    Console.WriteLine(result.IsValid
24        ? $"{label}: accepted, sub={result.Claims["sub"]}"
25        : $"{label}: rejected: {result.Exception.GetType().Name}: {result.Exception.Message.Split('.')[0]}"); // "IDXnnnnn: …"
26}

How it works

1. new JsonWebKeySet(json) parses the JWKS; GetSigningKeys() turns each usable JWK into a SecurityKey with its KeyId.
2. TokenValidationParameters lists what a valid token is: ValidIssuer, ValidAudience, IssuerSigningKeys, ValidAlgorithms and RequireExpirationTime.
3. ValidateTokenAsync returns a TokenValidationResult instead of throwing; IsValid, Claims and Exception describe the outcome.
4. The IDX codes identify the check that failed: IDX10214 audience, IDX10205 issuer, IDX10223 lifetime, IDX10503 no key for the kid.

Gotchas

• In ASP.NET Core, prefer AddJwtBearer with options.Authority: it reads the issuer's discovery document, fetches the JWKS and refreshes it on rotation. Loading the JWKS by hand, as here, suits workers and tests, and then refreshing is your job.
• Leaving ValidAudience unset does not skip the check, it fails (IDX10208: Unable to validate audience). ValidateAudience = false turns it off — and makes tokens for other APIs valid for yours.
• Exception messages hide values as [PII of type … is hidden] unless IdentityModelEventSource.ShowPII is on; enable it only in development.
• ValidAlgorithms is not set by default. Set it, so the accepted algorithm is part of your configuration rather than whatever the keys happen to support.

Related recipes

• How to sign a JWT with ES256 in C#
• How to compute a JWK thumbprint (RFC 7638) in C#
• How to verify a JWT with a JWKS in Java
• How to verify a JWT with a JWKS in Go