KeyVersion Struct
One version of a custodian-held key: its public half and when the custodian created that version. The
public key carries the version-specific kid that routes a private operation back to this exact
version, so publishing a key's versions lets a client verify a signature made by any of them and lets the
server unwrap a JWE encrypted to any of them. The creation time is what a rotation policy reads to hold a
freshly minted version as announced-but-not-yet-signing until client JWKS caches catch up (the propagation
window), and to keep a superseded version published until its tokens expire.
public readonly record struct KeyVersion : System.IEquatable<Abblix.Jwt.KeyVersion>Implements System.IEquatable<KeyVersion>
Constructors
KeyVersion(JsonWebKey, DateTimeOffset) Constructor
One version of a custodian-held key: its public half and when the custodian created that version. The
public key carries the version-specific kid that routes a private operation back to this exact
version, so publishing a key's versions lets a client verify a signature made by any of them and lets the
server unwrap a JWE encrypted to any of them. The creation time is what a rotation policy reads to hold a
freshly minted version as announced-but-not-yet-signing until client JWKS caches catch up (the propagation
window), and to keep a superseded version published until its tokens expire.
public KeyVersion(Abblix.Jwt.JsonWebKey PublicKey, System.DateTimeOffset CreatedAt);Parameters
PublicKey JsonWebKey
The public-only key material for this version, with its version-specific kid.
CreatedAt System.DateTimeOffset
When the custodian created this version. A custodian that does not track a creation time reports System.DateTimeOffset.MinValue, which a rotation policy treats as "always past the propagation window", so a single non-rotating key is always eligible to sign.
Properties
KeyVersion.CreatedAt Property
When the custodian created this version. A custodian that does not track a creation time reports System.DateTimeOffset.MinValue, which a rotation policy treats as "always past the propagation window", so a single non-rotating key is always eligible to sign.
public System.DateTimeOffset CreatedAt { get; init; }Property Value
KeyVersion.PublicKey Property
The public-only key material for this version, with its version-specific kid.
public Abblix.Jwt.JsonWebKey PublicKey { get; init; }