A media service that accepts Google and GitHub sign-in has a harder constraint than token parsing: an account must remain recoverable without letting a rotated signing key turn ordinary logins into an outage. Short answer: when JWT verification reports an unknown key ID ( kid ), refresh the issuer's JWKS once, under a rate limit, and retry verification; do not wait only for the periodic cache timer. Keep the last usable set during refresh, reject the token if the refreshed set still lacks the ...