The Dual-Key Verification Pattern
1. **Stage 1**: Add the new key (`KEY_V2`) to your server's key dictionary alongside the current key (`KEY_V1`).
2. **Stage 2**: Start signing all newly minted tokens with `KEY_V2`, setting `kid: "v2"` in the header.
3. **Stage 3**: Verification looks up the key matching the token's `kid`. Existing `v1` tokens validate against `KEY_V1`, while new `v2` tokens validate against `KEY_V2`.
4. **Stage 4**: Once `v1` token lifespans expire (e.g. 1 hour later), safely decommission `KEY_V1`.
Generate in Browser
Launch GeneratorNeed a cryptographically secure JWT secret right now?
Generate 128 to 512-bit keys in Hex or Base64 using Web Crypto with zero server transmission.
Frequently Asked Questions
Does this work for both HMAC and RSA keys?
Yes! The "kid" pattern is universal and works equally well for symmetric HMAC secrets and asymmetric RSA/ECDSA key pairs.
Related Technical Guides
Implementation
Secure JWT Environment Variables: 12-Factor App and Secret Management
Stop committing secrets. Learn the 12-Factor approach to JWT_SECRET: file permissions, Docker secrets, Kubernetes secrets, and cloud secret managers.
ImplementationTop 7 Critical JWT Authentication Mistakes Developers Make in Production
Avoid disastrous security flaws: "alg": "none", weak secrets, missing expiration, storing tokens in localStorage, and trusting client payloads.