#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Features\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ExternalKeys 'Abblix\.Oidc\.Server\.Features\.ExternalKeys')

## ExternalKeysProvider Class

Publishes the public halves of an [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian')'s signing and encryption keys to the OIDC
pipeline, one entry per current key version\. It never returns private material: each key is public\-only, which
is the signal the crypto seam reads to route the private operation to the custodian by `kid`\.
Version\-awareness rides the produce/publish split of [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider'): every version is
published \(so a client can verify a signature or encrypt a JWE to any of them, and a rotation overlaps\), while
the ACTIVE version \- the newest one past the server's [KeyRolloverPropagation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.KeyRolloverPropagation 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.KeyRolloverPropagation') window \-
leads the set, so the produce role signs and encrypts with it\. A freshly rotated version stays announced
\(published, trailing\) until it clears the window, so a client that has not refreshed its JWKS cache never sees
a token produced with a version it lacks\. One provider serves any custodian, so the Vault and Azure packages
carry no key provider of their own\.

```csharp
public sealed class ExternalKeysProvider : Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ExternalKeysProvider

Implements [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider')
### Constructors

## ExternalKeysProvider\(IKeyCustodian, CustodianHeldKeys, IOptions\<OidcOptions\>, TimeProvider\) Constructor {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.ExternalKeysProvider(Abblix.Jwt.ExternalKeys.IKeyCustodian,Abblix.Jwt.ExternalKeys.CustodianHeldKeys,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider)}

Publishes the public halves of an [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian')'s signing and encryption keys to the OIDC
pipeline, one entry per current key version\. It never returns private material: each key is public\-only, which
is the signal the crypto seam reads to route the private operation to the custodian by `kid`\.
Version\-awareness rides the produce/publish split of [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider'): every version is
published \(so a client can verify a signature or encrypt a JWE to any of them, and a rotation overlaps\), while
the ACTIVE version \- the newest one past the server's [KeyRolloverPropagation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.KeyRolloverPropagation 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.KeyRolloverPropagation') window \-
leads the set, so the produce role signs and encrypts with it\. A freshly rotated version stays announced
\(published, trailing\) until it clears the window, so a client that has not refreshed its JWKS cache never sees
a token produced with a version it lacks\. One provider serves any custodian, so the Vault and Azure packages
carry no key provider of their own\.

```csharp
public ExternalKeysProvider(Abblix.Jwt.ExternalKeys.IKeyCustodian custodian, Abblix.Jwt.ExternalKeys.CustodianHeldKeys keys, Microsoft.Extensions.Options.IOptions<Abblix.Oidc.Server.Common.Configuration.OidcOptions> options, System.TimeProvider timeProvider);
```
#### Parameters

###### `custodian` [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian') {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.ExternalKeysProvider(Abblix.Jwt.ExternalKeys.IKeyCustodian,Abblix.Jwt.ExternalKeys.CustodianHeldKeys,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).custodian}

###### `keys` [CustodianHeldKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.CustodianHeldKeys 'Abblix\.Jwt\.ExternalKeys\.CustodianHeldKeys') {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.ExternalKeysProvider(Abblix.Jwt.ExternalKeys.IKeyCustodian,Abblix.Jwt.ExternalKeys.CustodianHeldKeys,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).keys}

###### `options` [Microsoft\.Extensions\.Options\.IOptions&lt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.ExternalKeysProvider(Abblix.Jwt.ExternalKeys.IKeyCustodian,Abblix.Jwt.ExternalKeys.CustodianHeldKeys,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).options}

###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.ExternalKeysProvider(Abblix.Jwt.ExternalKeys.IKeyCustodian,Abblix.Jwt.ExternalKeys.CustodianHeldKeys,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).timeProvider}
### Methods

## ExternalKeysProvider\.GetEncryptionKeys\(bool\) Method {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.GetEncryptionKeys(bool)}

Gets the encryption keys used by the service\. The first key per algorithm is the one it encrypts outbound
tokens with; the rest are published so inbound JWE can be decrypted and to overlap a rotation\. See the
ordering note in the interface remarks\.

```csharp
public System.Collections.Generic.IAsyncEnumerable<Abblix.Jwt.JsonWebKey> GetEncryptionKeys(bool includePrivateKeys=false);
```
#### Parameters

###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.GetEncryptionKeys(bool).includePrivateKeys}

Whether to include private keys in the result\.

Implements [GetEncryptionKeys\(bool\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider.GetEncryptionKeys(bool) 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider\.GetEncryptionKeys\(bool\)')

#### Returns
[System\.Collections\.Generic\.IAsyncEnumerable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')

## ExternalKeysProvider\.GetSigningKeys\(bool\) Method {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.GetSigningKeys(bool)}

Gets the signing keys used by the service\. The first key per algorithm is the one it signs with; the rest
are published for verification and to overlap a rotation\. See the ordering note in the interface remarks\.

```csharp
public System.Collections.Generic.IAsyncEnumerable<Abblix.Jwt.JsonWebKey> GetSigningKeys(bool includePrivateKeys=false);
```
#### Parameters

###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.GetSigningKeys(bool).includePrivateKeys}

Whether to include private keys in the result\.

Implements [GetSigningKeys\(bool\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider.GetSigningKeys(bool) 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider\.GetSigningKeys\(bool\)')

#### Returns
[System\.Collections\.Generic\.IAsyncEnumerable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')