.. index:: single: open_id_jwks_cache .. _open_id_jwks_cache/0:

.. rst-class:: right

object

open_id_jwks_cache

JWKS caching and key-rotation helpers.

| Availability: | logtalk_load(open_id(loader))

| Author: Paulo Moura | Version: 1:0:0 | Date: 2026-07-12

| Compilation flags: | static, context_switching_calls

| Imports: | public :ref:`open_id_helpers <open_id_helpers/0>` | Uses: | :ref:`open_id_client <open_id_client/0>` | :ref:`open_id_jwt <open_id_jwt/0>` | :ref:`os <os/0>`

| Remarks: | (none)

| Inherited public predicates: |  :ref:`options_protocol/0::check_option/1`  :ref:`options_protocol/0::check_options/1`  :ref:`options_protocol/0::default_option/1`  :ref:`options_protocol/0::default_options/1`  :ref:`options_protocol/0::option/2`  :ref:`options_protocol/0::option/3`  :ref:`options_protocol/0::valid_option/1`  :ref:`options_protocol/0::valid_options/1`  

.. contents:: :local: :backlinks: top

Public predicates

.. index:: cached_jwks/3 .. _open_id_jwks_cache/0::cached_jwks/3:

cached_jwks/3 ^^^^^^^^^^^^^^^^^

Returns a cached JWKS for a provider, refreshing it when the cache is stale or missing.

| Compilation flags: | static

| Template: | cached_jwks(Provider,JWKSet,Options) | Mode and number of proofs: | cached_jwks(+compound,-term,+list(compound)) - one_or_error

| Exceptions: | Options is a variable or a partial list: | instantiation_error | Options is neither a variable nor a list: | type_error(list,Options) | An element Option of the list Options is neither a variable nor a compound term: | type_error(compound,Option) | An element Option of the list Options is a compound term but not a valid option: | domain_error(option,Option) | The provider metadata is missing a JWKS endpoint: | domain_error(open_id_provider,missing(jwks_uri)) | The JWKS endpoint returned a non-success status: | domain_error(open_id_http_status,Code) | The JWKS endpoint response body is not JSON: | domain_error(open_id_json_response,Body)

---

.. index:: verify_id_token/4 .. _open_id_jwks_cache/0::verify_id_token/4:

verify_id_token/4 ^^^^^^^^^^^^^^^^^^^^^

Verifies an ID-token using cached JWKS data, refreshing the cache once when the token key identifier is unknown.

| Compilation flags: | static

| Template: | verify_id_token(Token,Provider,Claims,Options) | Mode and number of proofs: | verify_id_token(+atom,+compound,-term,+list(compound)) - zero_or_one_or_error

| Exceptions: | Options is a variable or a partial list: | instantiation_error | Options is neither a variable nor a list: | type_error(list,Options) | An element Option of the list Options is neither a variable nor a compound term: | type_error(compound,Option) | An element Option of the list Options is a compound term but not a valid option: | domain_error(option,Option) | The provider metadata is missing a JWKS endpoint: | domain_error(open_id_provider,missing(jwks_uri)) | The JWKS endpoint returned a non-success status: | domain_error(open_id_http_status,Code) | The JWKS endpoint response body is not JSON: | domain_error(open_id_json_response,Body) | Token is a variable: | instantiation_error | Token is neither a variable nor an atom: | type_error(atom,Token) | Token is an atom but not a valid compact JWT: | domain_error(jwt_compact_serialization,Token) | Token contains Base64URL data with characters outside the Base64URL alphabet: | representation_error(base64) | The JWT header does not contain a valid alg member: | domain_error(jwt_header,Header) | The JWT algorithm is unsupported or disallowed: | domain_error(open_id_jwt_algorithm,Algorithm) | JWKSet is not a JSON Web Key Set with a keys list: | domain_error(jwt_jwks,JWKSet) | No compatible key exists for the JWT header: | existence_error(jwt_jwk,Header) | The selected JWK is not a supported public key: | domain_error(jwt_jwk_public_key,Key) | The ES256 signature is not 64 bytes long: | domain_error(jwt_es256_signature,Signature) | The OpenSSL executable does not exist: | existence_error(os_command,Executable) | The iss claim does not match the provider issuer: | domain_error(open_id_claim(iss),Value) | A required OpenID ID-token claim is missing: | domain_error(open_id_claims,missing(Name)) | The expected audience option is missing: | domain_error(open_id_claims,missing(expected_audience)) | An OpenID ID-token claim has an invalid value: | domain_error(open_id_claim(Name),Value) | An OpenID ID-token time claim value is not a number: | type_error(time_number,Name-Time)

---

.. index:: clear/0 .. _open_id_jwks_cache/0::clear/0:

clear/0 ^^^^^^^^^^^

Clears all cached JWKS entries.

| Compilation flags: | static

| Mode and number of proofs: | clear - one

---

.. index:: clear/1 .. _open_id_jwks_cache/0::clear/1:

clear/1 ^^^^^^^^^^^

Clears the cached JWKS entry for a provider.

| Compilation flags: | static

| Template: | clear(Provider) | Mode and number of proofs: | clear(+compound) - one_or_error

| Exceptions: | The provider metadata is missing a JWKS endpoint: | domain_error(open_id_provider,missing(jwks_uri))

---

Protected predicates

(no local declarations; see entity ancestors if any)

Private predicates

.. index:: cached_jwks_/3 .. _open_id_jwks_cache/0::cached_jwks_/3:

cached_jwks_/3 ^^^^^^^^^^^^^^^^^^

Cached JWKS entries indexed by URI and fetch time.

| Compilation flags: | dynamic

| Template: | cached_jwks_(URI,FetchedAt,JWKSet) | Mode and number of proofs: | cached_jwks_(?atom,?number,?term) - zero_or_more

---

Operators

(none)