#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Features\.ResourceIndicators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators')

## IAudienceKeyResolver Interface

Finds the one encryption key a token's audience published, if any\.

```csharp
public interface IAudienceKeyResolver
```

Derived  
↳ [AudienceKeyResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.AudienceKeyResolver 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.AudienceKeyResolver')

### Remarks
Owns the question rather than leaving its two halves \- resolving a resource to its definition and
reading that definition's keys \- to every consumer that asks it\. A token service needs the answer,
not the mechanics\.
### Methods

## IAudienceKeyResolver\.FindEncryptionKeyAsync\(IReadOnlyCollection\<Uri\>\) Method {#Abblix.Oidc.Server.Features.ResourceIndicators.IAudienceKeyResolver.FindEncryptionKeyAsync(System.Collections.Generic.IReadOnlyCollection_System.Uri_)}

The encryption key published by the audience named in [resources](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IAudienceKeyResolver#Abblix.Oidc.Server.Features.ResourceIndicators.IAudienceKeyResolver.FindEncryptionKeyAsync(System.Collections.Generic.IReadOnlyCollection_System.Uri_).resources 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IAudienceKeyResolver\.FindEncryptionKeyAsync\(System\.Collections\.Generic\.IReadOnlyCollection\<System\.Uri\>\)\.resources'), or `null`
when none of them publishes one\.

```csharp
System.Threading.Tasks.Task<Abblix.Jwt.JsonWebKey?> FindEncryptionKeyAsync(System.Collections.Generic.IReadOnlyCollection<System.Uri> resources);
```
#### Parameters

###### `resources` [System\.Collections\.Generic\.IReadOnlyCollection&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1')[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1') {#Abblix.Oidc.Server.Features.ResourceIndicators.IAudienceKeyResolver.FindEncryptionKeyAsync(System.Collections.Generic.IReadOnlyCollection_System.Uri_).resources}

The resources the token is minted for\.

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')

#### Exceptions

[System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException')  
Several of the named resources each publish an encryption key\.

### Remarks
A resource that publishes no key contributes nothing, which is how it says a signed JWS is what it
expects\. Several resources each publishing a key have no correct answer: compact JWE serialization
carries one recipient, so encrypting to one of them would silently leave the token unreadable to the
rest \- refuse instead of choosing\. Unknown resources never reach here, having been rejected as
`invalid_target` during request validation \(RFC 8707 Section 2\)\.