JWT Key Generation

AspFox uses RS256 (RSA + SHA-256) for JWT signing. This requires a key pair: a private key to sign tokens and a public key to verify them. Both keys must be base64-encoded before adding to .env.

Generate the keys

# Generate 4096-bit RSA key pair in PEM format
ssh-keygen -t rsa -b 4096 -m PEM -f jwt.key -N '""'

# Print the base64-encoded private key
[Convert]::ToBase64String([IO.File]::ReadAllBytes("jwt.key"))

# Print the base64-encoded public key
[Convert]::ToBase64String([IO.File]::ReadAllBytes("jwt.key.pub"))

# Generate 4096-bit RSA private key
openssl genrsa -out private.pem 4096

# Extract the public key
openssl rsa -in private.pem -pubout -out public.pem

# Print base64-encoded private key (no line breaks)
base64 -w 0 private.pem   # Linux
base64 private.pem         # macOS

# Print base64-encoded public key
base64 -w 0 public.pem    # Linux
base64 public.pem          # macOS

Add to .env

Copy each base64 string — the entire output, as one continuous string with no line breaks — into your .env:

JWT_PRIVATE_KEY=LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS…(long string)
JWT_PUBLIC_KEY=LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQ0lqQU5C…(long string)

Never commit key files to your git repository. The scaffolded .gitignore already includes these patterns:

*.key
*.pem
*.der
jwt-keys.txt

Verify they are present in your .gitignore before making any commits.

Why RS256 instead of HS256

HS256 uses a single shared secret for both signing and verification. Any service that needs to verify tokens must possess the secret — which means the secret has to be distributed to every service. RS256 uses asymmetric keys. Only the API server possesses the private key. Any service that needs to verify tokens gets only the public key. The public key cannot forge tokens; it can only verify them. This matters when you add services that verify AspFox tokens — an edge function, a serverless worker, a third-party integration. They get the public key and can verify tokens independently without any shared secret.

Generate new keys for each environment

Local development  →  one key pair
Staging            →  different key pair
Production         →  different key pair

Using the same keys across environments means that development JWTs are valid in production (and vice versa). This is a security vulnerability. Keep keys separate.

​Generate the keys

​Add to .env

​Why RS256 instead of HS256

​Generate new keys for each environment

Generate the keys

Add to .env

Why RS256 instead of HS256

Generate new keys for each environment