Generate an RS256 JWT for OAuth2 / OIDC Testing

Generate an RS256 JWT for OAuth2 / OIDC Testing

This example configures the JWT Generator for RS256 with OAuth2 and OpenID Connect claims. The tool generates a new RSA 2048-bit key pair on load and signs a JWT with iss, aud, sub, and standard profile claims.

The output includes the JWT string and the PEM formatted public key you need to configure on your API server. The private key is displayed in a collapsible section for debugging and local development.

Why RS256 Matters

OAuth2 and OpenID Connect mandate asymmetric signing for production deployments. The authorization server holds the private key and signs tokens. Resource servers (your APIs) hold only the public key and verify tokens without ever seeing the private key.

┌─────────────┐      signs with       ┌──────────────┐
│  Auth Server │ ── private key ──→  │    JWT       │
│  (Keycloak)  │                      │              │
└─────────────┘                      └──────┬───────┘
                                           │
                                    verifies with
                                      public key
                                           │
                                    ┌──────▼───────┐
                                    │  API Server  │
                                    └──────────────┘

This means you can have many API servers each configured with the same public key, without ever distributing a shared secret. If a server is compromised, the attacker gains the ability to verify tokens but not to forge them.

Claims in This Example

How to Use This Token

1. Load the example the tool auto selects RS256 and generates a new RSA key pair.
2. Copy the JWT string for your test request.
3. Copy the public key PEM and add it to your API servers JWT verification configuration.
4. Send the token in the Authorization header.
5. Use the JWT Decoder to verify the payload decodes correctly without checking the signature.

Testing the Full Flow

A realistic OAuth2 flow involves the authorization server returning a JWT, the client sending it to the API, and the API verifying it against a trusted public key. With this tool you simulate the first step and use the generated public key to configure the verification step.

For integration tests, extract the generated private key and configure your test identity provider stub to sign tokens with it. This lets your tests verify the entire auth chain without external dependencies.

Related Tools

Use the JWT Decoder to inspect tokens your identity provider issues. The JSON Formatter helps structure the claim payload during development.