To verify a JWT against a JWKS in Rust, fetch the key set with reqwest into jsonwebtoken's JwkSet, find the JWK named by the token's kid, and decode with a Validation that fixes the algorithm, issuer, audience and required claims. The run serves a real JWKS over HTTPS inside the container and checks five tokens.

Tested with jsonwebtoken 11.1.0 (Rust 1.99.1, feature rust_crypto) and reqwest 0.13.5 (blocking client, rustls with the platform verifier).

Cargo.toml — jsonwebtoken and reqwest

1[dependencies]
2jsonwebtoken = { version = "=11.1.0", features = ["rust_crypto"] }
3reqwest = { version = "=0.13.5", features = ["blocking", "json"] }
4serde = { version = "=1.0.229", features = ["derive"] }

src/verifier.rs — key by kid, then decode with a strict Validation

1use jsonwebtoken::jwk::JwkSet;
2use jsonwebtoken::{decode, decode_header, Algorithm, DecodingKey, Validation};
3use serde::Deserialize;
4 
5// Only the claims the application reads; exp, iss and aud are checked by Validation
6#[derive(Debug, Deserialize)]
7pub struct Claims {
8    pub sub: String,
9}
10 
11pub struct Verifier {
12    jwks: JwkSet, // fetch once and cache; refetch on a schedule or on an unknown kid
13    validation: Validation,
14}
15 
16impl Verifier {
17    pub fn new() -> Result<Self, Box<dyn std::error::Error>> {
18        let jwks: JwkSet = reqwest::blocking::get("https://issuer.example.com/.well-known/jwks.json")?
19            .error_for_status()?
20            .json()?;
21        let mut validation = Validation::new(Algorithm::ES256); // only ES256 is accepted
22        validation.set_issuer(&["https://issuer.example.com"]);
23        validation.set_audience(&["api://orders"]);
24        validation.set_required_spec_claims(&["exp", "iss", "aud"]);
25        Ok(Self { jwks, validation })
26    }
27 
28    pub fn verify(&self, token: &str) -> Result<Claims, Box<dyn std::error::Error>> {
29        let kid = decode_header(token)?.kid.ok_or("token has no kid")?;
30        let jwk = self.jwks.find(&kid).ok_or_else(|| format!("no key with kid {kid:?} in the JWKS"))?;
31        let key = DecodingKey::from_jwk(jwk)?;
32        Ok(decode::<Claims>(token, &key, &self.validation)?.claims)
33    }
34}

src/main.rs — check every token in tokens.txt

1mod verifier;
2 
3fn main() -> Result<(), Box<dyn std::error::Error>> {
4    let verifier = verifier::Verifier::new()?;
5    for line in std::fs::read_to_string("tokens.txt")?.lines() {
6        let (label, token) = line.split_once(' ').ok_or("bad line")?;
7        match verifier.verify(token) {
8            Ok(claims) => println!("{label}: accepted, sub={}", claims.sub),
9            Err(e) => println!("{label}: rejected: {e}"),
10        }
11    }
12    Ok(())
13}

How it works

reqwest::blocking::get(url)?.error_for_status()?.json() deserializes the JWKS straight into jsonwebtoken::jwk::JwkSet.
decode_header(token) reads the header without verifying it — only to get the kid; JwkSet::find(&kid) returns the matching JWK.
DecodingKey::from_jwk builds the verification key, and decode checks the ES256 signature, exp, iss and aud.
Validation::new(Algorithm::ES256) accepts only ES256; set_required_spec_claims makes exp, iss and aud mandatory.

Gotchas

jsonwebtoken validates aud by default: a token with an aud fails with InvalidAudience until set_audience names yours. That is the safe default — set the audience rather than switching validate_aud off.
The JWKS here is fetched once. A long-running service needs to refresh it periodically and when find misses, with a rate limit so invented kid values cannot trigger a fetch per request.
reqwest 0.13 verifies TLS with rustls and the platform verifier, which reads the system trust store; that is why the test CA works here after update-ca-certificates.
Deserialize only the claims you use. iss, aud and exp are checked by Validation whether or not they are fields of the claims struct.

How to verify a JWT with a JWKS in Rust

How it works

Gotchas

Related recipes