{"categories":[{"label":"Cryptography","url":"https://skillfed.io/packages/category/security-cryptography"}],"enrichment":{"capability":"Async library that automatically fetches and caches JSON Web Keys (JWKs) from OpenID Connect providers to verify JWT tokens, acting as a replacement for PyJWT's PyJWKClient.","skillfed_tags":["jwt-validation","openid-connect","async-http"],"use_cases":["Verify JWTs from multiple OpenID Connect providers in a microservice without hardcoding key endpoints.","Build an API gateway that validates tokens from external identity providers with automatic key rotation.","Implement token validation in async web frameworks (FastAPI, aiohttp) where blocking I/O is unacceptable.","Cache and reuse JWKS across many concurrent requests to reduce latency and provider load.","Support custom issuer configurations for non-standard or internal OpenID providers."],"what_it_does":"pyjwt-key-fetcher is an async wrapper around JWT key verification that automates the process of discovering and fetching signing keys from OpenID Connect providers. Instead of manually managing JWKS endpoints, you pass a token to AsyncKeyFetcher.get_key(), and it extracts the issuer and key ID, fetches the provider's configuration from .well-known/openid-configuration, retrieves the JWKS from the jwks_uri, and returns the matching key for use with PyJWT's decode function.\n\nThe library caches configuration and keys by default for up to 32 issuers with a 1-hour TTL, and re-fetches JWKs within 5 minutes if an unknown key ID appears for a known issuer. You can customize cache size, TTL, configuration paths, and provide static issuer configurations for providers that don't expose standard endpoints. It ships with aiohttp-based HTTP fetching but allows custom HTTP client implementations.","worth_installing":"Yes, if you need async JWT validation against OpenID Connect providers. The library solves a real problem (automatic key discovery and caching) and integrates cleanly with PyJWT. Install friction is low and dependencies are solid. The aging maintenance status (last release 2024-08-07, no recent commits) is a minor concern for a stable utility, but no known vulnerabilities and active repository status mitigate that risk. Suitable for production use in async applications."},"id":"pyjwt-key-fetcher","links":{"html":"https://skillfed.io/packages/pyjwt-key-fetcher","md":"https://skillfed.io/packages/pyjwt-key-fetcher.md","pypi":"https://pypi.org/project/pyjwt-key-fetcher/"},"maintenance":{"status":"aging"},"meta":{"latest_release":"2024-08-07","license_spdx":null,"license_treatment":"permissive","name":"pyjwt-key-fetcher","python_support":"supports_current","summary":"Async library to fetch JWKs for JWT tokens"},"popularity":{"monthly_downloads":447590,"position":6605,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"0.8.0"}