Add kid to JWT protected header so tokens match JWKS

[joergjaeckel]

Include kid (JWKS.keys[0].kid) in SignJWT().setProtectedHeader() for access_token and id_token so clients performing JWKS-based signature verification can find the correct public key.

Fixes #374

Summary by CodeRabbit

• Bug Fixes
  • Added the correct key identifier to signed access and identity tokens.
  • Improved token validation and key selection for OAuth flows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7279629b-a7f3-421e-a2ff-ee99e087180a

📥 Commits

Reviewing files that changed from the base of the PR and between c47423e and 9050d7d.

📒 Files selected for processing (1)

• .changes/change-pr-375.md

---

📝 Walkthrough

Walkthrough

JWT signing now includes JWKS.keys[0].kid in protected headers for client credentials access tokens and for access and ID tokens issued through other flows.

Changes

JWT key ID headers

Layer / File(s)	Summary
Include JWKS key IDs in issued tokens packages/auth0/src/handlers/oauth-handlers.ts, .changes/change-pr-375.md	Imports JWKS and adds its key ID to access and ID token protected headers. A patch changeset documents the update.

Estimated code review effort: 2 (Simple) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding the JWKS key ID to JWT protected headers.
Linked Issues check	✅ Passed	The changes add JWKS.keys[0].kid to access_token and id_token protected headers, resolving the linked issue's native SDK validation failures [#374].
Out of Scope Changes check	✅ Passed	All changes support the linked objective and include only the JWT header fix and its required patch-release changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[frontsidejack]

Package Changes Through 9050d7d

There are 1 changes which include @simulacrum/auth0-simulator with patch

Planned Package Versions

The following package releases are the planned based on the context of changes in this pull request.

package	current	next
@simulacrum/auth0-simulator	0.13.0	0.13.1

Add another change file through the GitHub UI by following this link.

---

Read about change files or the docs at github.com/jbolda/covector

[jbolda]

Makes sense to me. Thanks, appreciate it!

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@simulacrum/auth0-simulator@375

commit: 9050d7d