What this test does
Fetches jwks_uri from your metadata and checks the token's signature with the key naming its kid, as a resource server would.
How it passes
The metadata lists jwks_uri, it returns a JWKS, and the signature verifies.
- Specification
- RFC 9068 §4, RFC 8414 §2
- Needs
- S420 Access token format