JWKGuard

JWKGuard is a web app (with a lightweight CLI) that continuously monitors your JWT/JWK/OIDC setup and alerts you when things are about to break: expiring signing keys, unexpected key rotation, issuer/audience drift, algorithm misconfigurations, and risky token lifetimes. It runs synthetic auth checks against your identity provider and your APIs, validating real-world token verification behavior rather than just configuration. You get a dashboard showing current trust chains, key history, rotation cadence, and blast radius (which services rely on which keys). It also generates actionable runbooks: what to rotate, where to update JWKS caching, and how to roll keys safely. This is not “crypto research”; it’s operational cryptography for teams that keep getting paged by auth outages or security reviews. Expect some setup friction (OIDC discovery, service mapping), but once wired, it prevents costly incidents.