I'd like to be able to provide multiple valid secrets for a given request, preferably dynamically as well about express-jwt HOT 3 CLOSED

This is a very common case, for which the secret parameter accepts either a secret or a GetVerificationKey callback.

https://github.com/auth0/express-jwt#retrieve-key-dynamically

Ideally you will have a map of KIDs (key-ids to secrets) and then use the kid header as follows:

var getSecret = async function (req, token) {
  const { kid } = token.header;
  return secrets[kid];
};

Notice is an async function so you could store this on a database etc.

At some point your api will stop accepting jwts signed with the old key.

from express-jwt.

Thanks! I have no idea why I didn't think of that.

It might be worth calling out in the README in that section as well as an example so others can see how it'd be done.

from express-jwt.

Good call, thank you. I added an example in the readme

from express-jwt.