# Kong API Gateway and JWKS for validatin JWT's **URL:** \ **Category:** General\ **Tags:** kong-gateway\ **Created:** [December 8, 2020, 4:26pm UTC](https://discuss.konghq.com/t/kong-api-gateway-and-jwks-for-validatin-jwts/7559 "2020-12-08T16:26:13Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Robert\_Metcalf](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/robert_metcalf/32/150_2.png) [@Robert\_Metcalf](https://discuss.konghq.com/u/Robert_Metcalf)\ **Post date:** [December 8, 2020, 4:26pm UTC](https://discuss.konghq.com/t/kong-api-gateway-and-jwks-for-validatin-jwts/7559/1 "2020-12-08T16:26:13Z")
I am using the Kong API Gateway in DB-less mode as a sidecar container. This does the JWT verification for my RS256 tokens. I have got this working by supplying a static public key as part of the kong.yml. I now need to update what I have done so it uses a JWKS endpoint in order to get the public keys that it uses. I have thought of a number of approaches to this and I would like to know what others think. 1. I could establish a second process in the kong container that independatly access the JWKS endpoint. If it finds a changed set of keys it could re-generate a new kong.yml and call the API endpoint to refresh the Kong configuration. 2. I could take a copy of the current JWT plugin from [kong/kong/plugins/jwt at master · Kong/kong · GitHub](https://github.com/Kong/kong/tree/master/kong/plugins/jwt) and alter it so that it does the retrival and caching process. 3. In the JWT plugin I have noticed it retrieves the key from the DB (or cache) [kong/kong/plugins/jwt/handler.lua at master · Kong/kong · GitHub](https://github.com/Kong/kong/blob/master/kong/plugins/jwt/handler.lua#L160) I was thinking is it possible to write a global JWKS loader plugin that runs every 10 minutes, checks the endpoint and populates the kong DB/cache with the result? This would have the effect of making the existing JWT plugin work with the keys provided. I would like to know thoughts on the above or if I am missing an easier solution. (I am aweare of the jwt-signer plugin but that seems to be enterprise only and it only seems to be for signing upstream requests.)