# Master secret key to validate JWT Token

**URL:** <https://discuss.konghq.com/t/master-secret-key-to-validate-jwt-token/2395>\
**Category:** Feature Requests & Feedback\
**Created:** [December 7, 2018, 11:22am UTC](https://discuss.konghq.com/t/master-secret-key-to-validate-jwt-token/2395 "2018-12-07T11:22:37Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Amol\_Ghatol](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/amol_ghatol/32/325_2.png) [@Amol\_Ghatol](https://discuss.konghq.com/u/Amol_Ghatol)\
**Post date:** [December 7, 2018, 11:22am UTC](https://discuss.konghq.com/t/master-secret-key-to-validate-jwt-token/2395/1 "2018-12-07T11:22:37Z")

</div>

To validate the JWT token, jwt plugins decode the token to get the key and then read the secret key mapped to it from cache/database.

We have a use case where one consumer have 52 million credentials(52 million records in the jwt\_secrets table against one consumer) and this still growing.

For this size of large-scale, having the different secret per key would be ineffective for JWT validation.

Is there any way like having a single master secret key to validate all the jwt tokens or at least tokens issued for one consumer. Is this practical?