My app uses OpenID Connect.
I created the certificate, then updated the app to use newly created kid using /credentials/keys. What I expect is that /keys?client_id={id} endpoint returns a key with kid equals to what I’ve created and tokens are signed/verified with a private/public key pair OKTA created for me as result of that certificate update. But /keys contains absolutely different kids and token validation fails.
What is wrong here? Maybe I’m misunderstanding the purpose of /credentials/keys? Maybe it would work ok only in certain context?
Documentaton says: Note: When using a Custom Authorization Server, you may work with a client that can’t call the /keys endpoint to dynamically fetch the JWKS. You can pin that specific client to a specific key by generating a key credential and updating the application to use it for signing. This overrides the Custom AS rollover/pinning behavior for that client. Should you need to turn off automatic key rotation for the entire Custom Authorization Server, you can do that by switching the Signing Key Rotation value to Manual in the Admin Console.