.. index:: single: open_id_jwks_cache .. _open_id_jwks_cache/0: .. rst-class:: right **object** ``open_id_jwks_cache`` ====================== JWKS caching and key-rotation helpers. | **Availability:** | ``logtalk_load(open_id(loader))`` | **Author:** Paulo Moura | **Version:** 1:0:0 | **Date:** 2026-07-12 | **Compilation flags:** | ``static, context_switching_calls`` | **Imports:** | ``public`` :ref:`open_id_helpers ` | **Uses:** | :ref:`open_id_client ` | :ref:`open_id_jwt ` | :ref:`os ` | **Remarks:** | (none) | **Inherited public predicates:** |  :ref:`options_protocol/0::check_option/1`  :ref:`options_protocol/0::check_options/1`  :ref:`options_protocol/0::default_option/1`  :ref:`options_protocol/0::default_options/1`  :ref:`options_protocol/0::option/2`  :ref:`options_protocol/0::option/3`  :ref:`options_protocol/0::valid_option/1`  :ref:`options_protocol/0::valid_options/1`   .. contents:: :local: :backlinks: top Public predicates ----------------- .. index:: cached_jwks/3 .. _open_id_jwks_cache/0::cached_jwks/3: ``cached_jwks/3`` ^^^^^^^^^^^^^^^^^ Returns a cached JWKS for a provider, refreshing it when the cache is stale or missing. | **Compilation flags:** | ``static`` | **Template:** | ``cached_jwks(Provider,JWKSet,Options)`` | **Mode and number of proofs:** | ``cached_jwks(+compound,-term,+list(compound))`` - ``one_or_error`` | **Exceptions:** | ``Options`` is a variable or a partial list: | ``instantiation_error`` | ``Options`` is neither a variable nor a list: | ``type_error(list,Options)`` | An element ``Option`` of the list ``Options`` is neither a variable nor a compound term: | ``type_error(compound,Option)`` | An element ``Option`` of the list ``Options`` is a compound term but not a valid option: | ``domain_error(option,Option)`` | The provider metadata is missing a JWKS endpoint: | ``domain_error(open_id_provider,missing(jwks_uri))`` | The JWKS endpoint returned a non-success status: | ``domain_error(open_id_http_status,Code)`` | The JWKS endpoint response body is not JSON: | ``domain_error(open_id_json_response,Body)`` ------------ .. index:: verify_id_token/4 .. _open_id_jwks_cache/0::verify_id_token/4: ``verify_id_token/4`` ^^^^^^^^^^^^^^^^^^^^^ Verifies an ID-token using cached JWKS data, refreshing the cache once when the token key identifier is unknown. | **Compilation flags:** | ``static`` | **Template:** | ``verify_id_token(Token,Provider,Claims,Options)`` | **Mode and number of proofs:** | ``verify_id_token(+atom,+compound,-term,+list(compound))`` - ``zero_or_one_or_error`` | **Exceptions:** | ``Options`` is a variable or a partial list: | ``instantiation_error`` | ``Options`` is neither a variable nor a list: | ``type_error(list,Options)`` | An element ``Option`` of the list ``Options`` is neither a variable nor a compound term: | ``type_error(compound,Option)`` | An element ``Option`` of the list ``Options`` is a compound term but not a valid option: | ``domain_error(option,Option)`` | The provider metadata is missing a JWKS endpoint: | ``domain_error(open_id_provider,missing(jwks_uri))`` | The JWKS endpoint returned a non-success status: | ``domain_error(open_id_http_status,Code)`` | The JWKS endpoint response body is not JSON: | ``domain_error(open_id_json_response,Body)`` | ``Token`` is a variable: | ``instantiation_error`` | ``Token`` is neither a variable nor an atom: | ``type_error(atom,Token)`` | ``Token`` is an atom but not a valid compact JWT: | ``domain_error(jwt_compact_serialization,Token)`` | ``Token`` contains Base64URL data with characters outside the Base64URL alphabet: | ``representation_error(base64)`` | The JWT header does not contain a valid ``alg`` member: | ``domain_error(jwt_header,Header)`` | The JWT algorithm is unsupported or disallowed: | ``domain_error(open_id_jwt_algorithm,Algorithm)`` | ``JWKSet`` is not a JSON Web Key Set with a ``keys`` list: | ``domain_error(jwt_jwks,JWKSet)`` | No compatible key exists for the JWT header: | ``existence_error(jwt_jwk,Header)`` | The selected JWK is not a supported public key: | ``domain_error(jwt_jwk_public_key,Key)`` | The ES256 signature is not 64 bytes long: | ``domain_error(jwt_es256_signature,Signature)`` | The OpenSSL executable does not exist: | ``existence_error(os_command,Executable)`` | The ``iss`` claim does not match the provider issuer: | ``domain_error(open_id_claim(iss),Value)`` | A required OpenID ID-token claim is missing: | ``domain_error(open_id_claims,missing(Name))`` | The expected audience option is missing: | ``domain_error(open_id_claims,missing(expected_audience))`` | An OpenID ID-token claim has an invalid value: | ``domain_error(open_id_claim(Name),Value)`` | An OpenID ID-token time claim value is not a number: | ``type_error(time_number,Name-Time)`` ------------ .. index:: clear/0 .. _open_id_jwks_cache/0::clear/0: ``clear/0`` ^^^^^^^^^^^ Clears all cached JWKS entries. | **Compilation flags:** | ``static`` | **Mode and number of proofs:** | ``clear`` - ``one`` ------------ .. index:: clear/1 .. _open_id_jwks_cache/0::clear/1: ``clear/1`` ^^^^^^^^^^^ Clears the cached JWKS entry for a provider. | **Compilation flags:** | ``static`` | **Template:** | ``clear(Provider)`` | **Mode and number of proofs:** | ``clear(+compound)`` - ``one_or_error`` | **Exceptions:** | The provider metadata is missing a JWKS endpoint: | ``domain_error(open_id_provider,missing(jwks_uri))`` ------------ Protected predicates -------------------- (no local declarations; see entity ancestors if any) Private predicates ------------------ .. index:: cached_jwks_/3 .. _open_id_jwks_cache/0::cached_jwks_/3: ``cached_jwks_/3`` ^^^^^^^^^^^^^^^^^^ Cached JWKS entries indexed by URI and fetch time. | **Compilation flags:** | ``dynamic`` | **Template:** | ``cached_jwks_(URI,FetchedAt,JWKSet)`` | **Mode and number of proofs:** | ``cached_jwks_(?atom,?number,?term)`` - ``zero_or_more`` ------------ Operators --------- (none)