#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')

## Abblix\.Oidc\.Server\.Features\.ExternalKeys Namespace

| Classes | |
| :--- | :--- |
| [ExternalKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider 'Abblix\.Oidc\.Server\.Features\.ExternalKeys\.ExternalKeysProvider') | Publishes the public halves of an [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian')'s signing and encryption keys to the OIDC pipeline, one entry per current key version\. It never returns private material: each key is public\-only, which is the signal the crypto seam reads to route the private operation to the custodian by `kid`\. Version\-awareness rides the produce/publish split of [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider'): every version is published \(so a client can verify a signature or encrypt a JWE to any of them, and a rotation overlaps\), while the ACTIVE version \- the newest one past the server's [KeyRolloverPropagation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.KeyRolloverPropagation 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.KeyRolloverPropagation') window \- leads the set, so the produce role signs and encrypts with it\. A freshly rotated version stays announced \(published, trailing\) until it clears the window, so a client that has not refreshed its JWKS cache never sees a token produced with a version it lacks\. One provider serves any custodian, so the Vault and Azure packages carry no key provider of their own\. |