#### [Abblix\.SecurityEvents](https://www.abblix.com/en/docs/api/abblix-securityevents 'index')
### [Abblix\.SecurityEvents\.Abstractions](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.Abstractions 'Abblix\.SecurityEvents\.Abstractions')

## IIssuerKeyResolver Interface

Answers which keys an issuer's signatures may verify against \- the trust decision the
signature check delegates, since WHO holds an issuer's keys is deployment knowledge no
library can carry\.

```csharp
public interface IIssuerKeyResolver
```

Derived  
↳ [JwksIssuerKeyResolver](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.Infrastructure.JwksIssuerKeyResolver 'Abblix\.SecurityEvents\.Infrastructure\.JwksIssuerKeyResolver')

### Remarks
An issuer this resolver yields no keys for is an issuer whose tokens cannot be accepted, and
the verifier reports that as a key miss rather than a bad signature: after a key rollover a
refetch may heal a miss, which a wrong signature never becomes\.
### Methods

## IIssuerKeyResolver\.ResolveSigningKeysAsync\(string, string, CancellationToken\) Method {#Abblix.SecurityEvents.Abstractions.IIssuerKeyResolver.ResolveSigningKeysAsync(string,string,System.Threading.CancellationToken)}

Resolves the signature verification keys of an issuer\.

```csharp
System.Collections.Generic.IAsyncEnumerable<Abblix.Jwt.JsonWebKey> ResolveSigningKeysAsync(string issuer, string? keyId=null, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));
```
#### Parameters

###### `issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.SecurityEvents.Abstractions.IIssuerKeyResolver.ResolveSigningKeysAsync(string,string,System.Threading.CancellationToken).issuer}

The issuer as its tokens spell it in "iss"\.

###### `keyId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.SecurityEvents.Abstractions.IIssuerKeyResolver.ResolveSigningKeysAsync(string,string,System.Threading.CancellationToken).keyId}

The "kid" the token's header names, when it names one\. This is the key\-rollover signal: a
caching implementation that holds keys for the issuer but none under this identifier knows
its copy predates a rotation and refreshes before answering, instead of failing a token
signed with a key newer than the cache\.

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.SecurityEvents.Abstractions.IIssuerKeyResolver.ResolveSigningKeysAsync(string,string,System.Threading.CancellationToken).cancellationToken}

Cancels retrieval mid\-flight\.

#### Returns
[System\.Collections\.Generic\.IAsyncEnumerable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')  
The issuer's current verification keys; empty when the issuer is not trusted\.