seamless init (managed path) writes a hardcoded MANAGED_JWKS_KID = "dev-main" into the scaffolded backend as JWKS_KID (src/commands/init.ts ~:50, ~:186-214). Managed instances sign tokens with a per-tier kid (trialkey1 for trials, paidkey1 for paid), not dev-main.
This only works if the @seamless-auth/express adapter/SDK selects the JWKS key by the kid in the token header and ignores the configured JWKS_KID. If it honors JWKS_KID, every login against a CLI-scaffolded app fails verification.
Ask: confirm the SDK resolves the key by token-header kid (and if so, drop the misleading hardcoded value or make it clearly a non-op for managed), or fetch/set the instance's real active kid during managed init.
Found while planning the seamless-cli managed-instance connect test.
seamless init(managed path) writes a hardcodedMANAGED_JWKS_KID = "dev-main"into the scaffolded backend asJWKS_KID(src/commands/init.ts~:50, ~:186-214). Managed instances sign tokens with a per-tier kid (trialkey1for trials,paidkey1for paid), notdev-main.This only works if the
@seamless-auth/expressadapter/SDK selects the JWKS key by thekidin the token header and ignores the configuredJWKS_KID. If it honorsJWKS_KID, every login against a CLI-scaffolded app fails verification.Ask: confirm the SDK resolves the key by token-header
kid(and if so, drop the misleading hardcoded value or make it clearly a non-op for managed), or fetch/set the instance's real active kid during managed init.Found while planning the seamless-cli managed-instance connect test.