Jwks doesn't have key to match kid or alg from JWT (client credentials token)

[vlad.koshkarov]

Good day FusionAuth Team!

I followed the instructions to configure and test OAuth Client Credentials Grant with Entities [https://fusionauth.io/docs/v1/tech/oauth/#example-client-credentials-grant], but the JWT access token that was produced has a kid that is not in our JWKS endpoint (/.well-known/jwks.json), therefore we can't pass authentication in our system.

On the same tenant, when a user logs in with the Authorization Code Grant Flow with PKCE, the key is signed with the kid that is in the JWKS endpoint (/.well-known/jwks.json). So everything works fine.

Am I missing something here?

Thank you.

[vlad.koshkarov]

The tenant is using the "Default signing key (HS256)" for the access token.