Observed Signal · Apr 26, 2026 · Technical Release · Source: DEV Community · Impact: 2/5 · Sentiment: Positive
Persistent JWT Signing Keys Using PostgreSQL
A technical how-to showing how to replace an in-memory JWKS key store with PostgreSQL-backed persistent stores for an OpenID Connect / OIDC authorization server. The article provides two Postgres-backed implementations: a JwksKeyStore that stores private keys using envelope encryption (per-key DEK encrypted with a master KEK via AES-256-GCM) and a JwksRotationTimestampStore that derives rotation time from the private key record's created_at timestamp. It includes database schema, Node/Bun code for DB access, crypto helpers, store implementations, integration points with @saurbit/oauth2-jwt (JoseJwksAuthority and JwksRotator), and instructions to run the example (GitHub repo: shygyver/auth-playground). Required env vars are DATABASE_URL and a base64-encoded 32-byte MASTER_KEY. Publication date: 2026-04-26.
Provides a concrete, secure implementation pattern for persistent JWT signing key management and rotation in OIDC servers; valuable operational guidance but not industry-shifting.
Track GitHub Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Article demonstrates swapping an in-memory JWKS key store for two PostgreSQL-backed stores: JwksKeyStore and JwksRotationTimestampStore.
- Private keys are stored encrypted using envelope encryption: a per-key DEK (AES-256-GCM) wraps the serialized private key; the DEK is itself wrapped with a master KEK loaded from MASTER_KEY.
- Database schema includes two tables: private_keys (single active row enforced by CHECK(id = 1) and UNIQUE(id)) and public_keys (accumulates public keys until expires_at).
- Code and runnable example are published on GitHub at shygyver/auth-playground (apps/oidc-persistent-app) and use @saurbit/oauth2-jwt's JoseJwksAuthority and JwksRotator.
- Operational requirements: a PostgreSQL DATABASE_URL and MASTER_KEY (base64-encoded 32-byte KEK); server runs key rotation checks on startup and hourly, preserving overlapping public keys until expires_at.
Connected Companies & Entities
5 Entities mappedOntology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
JWT Lifecycle vs Secret Rotation: Security Comparison
A technical blog post comparing two complementary JWT security practices: token lifecycle management and secret key rotation. The author argues for short-lived access tokens (commonly 15 minutes to 1 hour) paired with longer-lived refresh tokens and a blacklist/revocation mechanism (example implementation using Redis). For signing keys, the author recommends regular rotation (typical cadence 30–90 days) automated via scripts or CI/CD and smooth transitions using key rollover or JWKS for asymmetric keys. Practical examples include FastAPI, Redis, PostgreSQL, systemd timers for rotation scripts, Docker secrets or Vault for secret distribution, and pitfalls encountered (Redis OOM eviction issues; rotation scripts being OOM‑killed). The post concludes both strategies should be used together and automated to reduce operational errors.
JWT Tokens: Stateless Authentication and Revocation Trade-offs
This technical guide explains JSON Web Tokens (JWT): their purpose, structure, signing algorithms, validation checklist, and the inherent revocation trade-offs. JWTs are compact, three-part (header, payload, signature) tokens encoded with Base64URL; payloads are readable but integrity-protected by a signature. Signing algorithms fall into symmetric (HS256) and asymmetric (RS256, ES256) families — asymmetric keys are recommended for distributed/microservice verification. Proper validation requires signature verification plus checks for exp, nbf, iss, aud, and optional jti-based revocation. The article outlines common attacks (notably the alg: none and HS256/RS256 confusion vulnerabilities), secret-strength guidance, browser storage trade-offs, and three practical revocation patterns: short expiries, access+refresh token separation, and jti blocklists (with their cost in lost statelessness).
JWT Security Checklist — 12 Checks Before Shipping
A developer-published checklist detailing 12 concrete JWT security checks to run before deploying production authentication. The guidance covers secret generation (use CSPRNG), explicit algorithm verification, validating exp/iss/aud claims, preferring httpOnly cookies over localStorage, enforcing HTTPS, server-side revocable refresh tokens, jti-based immediate revocation, environment-specific secrets, avoiding secrets in source control, generic error messages, and excluding sensitive data from JWT payloads. The article includes short code examples for Node.js and Python and references a longer version hosted on an external blog.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.