# `Ankusa.Admin.Auth.JWT.Keys`
[🔗](https://github.com/jamescarr/ankusa/blob/ankusa-v0.7.0/packages/ankusa/lib/ankusa/admin/auth/jwt/keys.ex#L1)

The signing keys `Ankusa.Admin.Auth.JWT` verifies against, for every control
plane of an instance that runs `mode: :jwt`. Started with the instance (only
when some listener needs it).

Each listener's keys are the `jwt.keys` it was configured with, loaded at
start, plus the keys of its `jwt.jwks_url`:

  * fetched right after start, without delaying it, and again every
    `jwt.refresh_ms`;
  * refetched early, at most once per `jwt.min_refresh_ms`, when a token names
    a `kid` that is not in the set (the provider rotated its keys);
  * kept, not dropped, when a refetch fails: a provider outage must not lock
    operators out of a running node. The failure is a warning and the next
    attempt comes sooner. Until the first fetch succeeds there are no keys and
    every token is refused.

Only public RSA, EC and OKP keys are kept; a JWKS entry for encryption
(`use: "enc"`), a shared key or a private key is skipped. The set is read from
an ETS table by the request, never through this process.

# `candidates`

```elixir
@spec candidates(atom(), Ankusa.Admin.Auth.section(), String.t() | nil) :: [
  JOSE.JWK.t()
]
```

The keys that may have signed a token with this `kid` (`nil`: the token has
none): the keys with that id and the keys with no id. `[]` while nothing is
loaded.

# `child_spec`

Returns a specification to start this module under a supervisor.

See `Supervisor`.

# `refresh`

```elixir
@spec refresh(atom(), Ankusa.Admin.Auth.section()) :: :ok
```

Ask for the JWKS of `section` to be fetched again, unless it was fetched less
than `jwt.min_refresh_ms` ago. Never blocks.

# `reload`

```elixir
@spec reload(atom(), Ankusa.Admin.Auth.section()) :: :ok | {:error, term()}
```

Fetch the JWKS of `section` now, whatever `jwt.min_refresh_ms` says.

# `start_link`

```elixir
@spec start_link(keyword()) :: GenServer.on_start()
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*