Module auth_keys

Key registry for JWS (JWT/DPoP/delegation) signature verification.

Supports rotation: a new key with the same kid can be added while the old one remains valid for a configurable grace period.

Lives in agentguard-core (not agentguard-auth) because the registry itself has no auth-specific dependencies — Algorithm and KeyMaterial are the JOSE primitives, and the same registry is shared by the JWT validator (agentguard-auth), the DPoP verifier (which doesn’t currently use a registry but could), and the delegation verifier (agentguard-core::delegation).

Structs

KeyRegistry

Thread-safe registry of trusted verification keys, keyed by kid.

ParseAlgorithmError

Error from parsing a Algorithm string.

Enums

Algorithm

JWS signing algorithm (RFC 7518, RFC 8725 §3.1).

KeyMaterial

Key material — abstracted so the registry can hold heterogeneous keys.

Constants

DEFAULT_KEY_KID_CAP

Default cap on the number of distinct kids a KeyRegistry will hold. Mirrors the cap enforced inside JwtValidator::refresh_jwks so the two cannot drift.

Functions

parse_alg

Parse a JOSE algorithm name into our Algorithm enum.