IAuthServiceKeysStore Interface

The write-role counterpart to IAuthServiceKeysProvider: it persists a service key at the moment it is generated, so its public half survives even when the external keystore that holds the private half exposes it only once. Reading stays with IAuthServiceKeysProvider.

public interface IAuthServiceKeysStore

Remarks

The roles are segregated deliberately (Interface Segregation): this is NOT IAuthServiceKeysStore : IAuthServiceKeysProvider. A component that only reads keys (the JWKS endpoint, the token validators) depends on the reader alone and is never coupled to persistence; the key generator depends on the writer alone. A persistent implementation implements BOTH role interfaces over one durable backend, but the two contracts stay decoupled. The durable backend, key generation, and the rotation that advances a descriptor's status ship separately.

Methods

IAuthServiceKeysStore.AddAsync(AuthServiceKeyDescriptor, CancellationToken) Method

Persists a newly generated key with its lifecycle window, so it is available to the read seam for verification and publication before it is ever used to sign (publish-before-sign).

System.Threading.Tasks.Task AddAsync(Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor descriptor, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));