#### [Abblix\.Oidc\.Server](https://www.abblix.com/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Common\.Interfaces](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces 'Abblix\.Oidc\.Server\.Common\.Interfaces')

## IAuthServiceKeysProvider Interface

Provides the keys of the OpenID Connect service to encrypt and sign the JWT tokens it issues, and to publish
their public halves at the JWKS endpoint\.

```csharp
public interface IAuthServiceKeysProvider
```

Derived  
↳ [ExternalKeysProvider](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider 'Abblix\.Oidc\.Server\.Features\.ExternalKeys\.ExternalKeysProvider')

### Remarks
The set has two distinct roles\. PUBLISHING: the whole set is published at the JWKS endpoint, so a client can
verify a signature made with ANY of these keys \(including one the service no longer signs with\) and encrypt
an inbound JWE to ANY of them \(the service decrypts with whichever key the client chose by `kid`\)\. This
holds even for a static multi\-key configuration, independent of rotation\. PRODUCING: the service itself signs
a token, and encrypts an outbound service token, with a SINGLE key per algorithm \- by convention the FIRST one
returned for that algorithm\. Only the produce role depends on order; a consumer selects by `kid`, not by
position\. The split is also what lets a single flat set carry a zero\-downtime rotation: return a new key AFTER
the active one to announce it \(published and immediately verifiable / encryptable, but not yet produced with\),
move it to first to activate it once client JWKS caches have caught up, and keep a retired key trailing \(still
published so its tokens keep verifying\) until they expire\. Do NOT order the set so that a retired or
not\-yet\-active key comes first for its algorithm, or the service would produce with it\.
### Methods

## IAuthServiceKeysProvider\.GetEncryptionKeys\(bool\) Method {#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider.GetEncryptionKeys(bool)}

Gets the encryption keys used by the service\. The first key per algorithm is the one it encrypts outbound
tokens with; the rest are published so inbound JWE can be decrypted and to overlap a rotation\. See the
ordering note in the interface remarks\.

```csharp
System.Collections.Generic.IAsyncEnumerable<Abblix.Jwt.JsonWebKey> GetEncryptionKeys(bool includePrivateKeys=false);
```
#### Parameters

###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider.GetEncryptionKeys(bool).includePrivateKeys}

Whether to include private keys in the result\.

#### Returns
[System\.Collections\.Generic\.IAsyncEnumerable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')

## IAuthServiceKeysProvider\.GetSigningKeys\(bool\) Method {#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider.GetSigningKeys(bool)}

Gets the signing keys used by the service\. The first key per algorithm is the one it signs with; the rest
are published for verification and to overlap a rotation\. See the ordering note in the interface remarks\.

```csharp
System.Collections.Generic.IAsyncEnumerable<Abblix.Jwt.JsonWebKey> GetSigningKeys(bool includePrivateKeys=false);
```
#### Parameters

###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider.GetSigningKeys(bool).includePrivateKeys}

Whether to include private keys in the result\.

#### Returns
[System\.Collections\.Generic\.IAsyncEnumerable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')