Can I verify real tokens with this key?

No. The RSA key is illustrative and there is no matching private key, so nothing can produce a signature it would validate. Use it to test JWKS parsing and caching, not signature verification.

How do I test key rotation?

Add a second entry to the keys array with a different kid, then edit the mock to remove the first. A client that caches the key set indefinitely will keep failing after the removal — which is the bug this test is meant to expose.

What happens if a token references an unknown kid?

A correct client refetches the key set once, then rejects the token if the key is still absent. Serving a set that lacks the expected kid is the cleanest way to check your client does not loop or crash.

Mock a JWKS endpoint for JWT verification

A GET mock at /.well-known/jwks.json returning one RSA key in JWK Set format.

A JWKS endpoint publishes the public keys a client uses to verify JWT signatures. This template serves a JWK Set containing one RSA key at /.well-known/jwks.json, so you can test that your client fetches, parses and caches the key set — including how it behaves when a key ID is missing or rotated.

Stands in for a third-party API endpoint.

Response payload

{
  "keys": [
    {
      "kty": "RSA",
      "use": "sig",
      "alg": "RS256",
      "kid": "quickmock-demo-2024",
      "n": "n6cS6BgeHi-qEzBkR5cS-MPBwt1dG9y-tGiSTw8Uov3jMu9Yiz6Oua5dg6xKnEhP20owo6iHI_MMSjU6Sb6iKSyIskDb5myN9DHC6exkDsoKPn5tPOIbzXeV0SaF-b3BejNwakl5nfHVHFMkbLCvx9KP985_5k3b7hD1UTdBOFYLIgHWTIlUkV1L9o5DoiGMm2GYWxww3tL_ZFllp4i4yyPP6c4D_J7kgFukBBZZBGe3Ou1QvzcNUYoaRNRK1PRBsC24xSfN1oZYBd4xpg6Kp3xmpsGR2nzWCviSWbvHatFusy_NqCq2Io1EAeup_i0eIN86t2-G7rn4Uoul27BQcQ",
      "e": "AQAB"
    }
  ]
}

Fields worth knowing

Field	What it means
keys	The JWK Set array; add more entries to test key-rotation logic.
keys.0.kid	The key ID a JWT's header would reference to pick this key.
keys.0.alg	The signing algorithm this key claims to support.
keys.0.n	The RSA modulus, base64url-encoded — illustrative only, not a working key.

Create the mock

curl -X POST https://quickmock.dev/api/mocks \
  -H 'Content-Type: application/json' \
  -d '{
  "method": "GET",
  "response_status": 200,
  "content_type": "application/json",
  "path_suffix": ".well-known/jwks.json",
  "response_body": "{\"keys\":[{\"kty\":\"RSA\",\"use\":\"sig\",\"alg\":\"RS256\",\"kid\":\"quickmock-demo-2024\",\"n\":\"n6cS6BgeHi-qEzBkR5cS-MPBwt1dG9y-tGiSTw8Uov3jMu9Yiz6Oua5dg6xKnEhP20owo6iHI_MMSjU6Sb6iKSyIskDb5myN9DHC6exkDsoKPn5tPOIbzXeV0SaF-b3BejNwakl5nfHVHFMkbLCvx9KP985_5k3b7hD1UTdBOFYLIgHWTIlUkV1L9o5DoiGMm2GYWxww3tL_ZFllp4i4yyPP6c4D_J7kgFukBBZZBGe3Ou1QvzcNUYoaRNRK1PRBsC24xSfN1oZYBd4xpg6Kp3xmpsGR2nzWCviSWbvHatFusy_NqCq2Io1EAeup_i0eIN86t2-G7rn4Uoul27BQcQ\",\"e\":\"AQAB\"}]}"
}'

Call it

curl https://quickmock.dev/m/<slug>/.well-known/jwks.json

What you get

GET /m/<slug>/.well-known/jwks.json -> 200 one RSA JWK
the key is illustrative only, it does not verify any real signature

How this differs from the real thing

The RSA key in this document is illustrative only — Quickmock doesn't hold a matching private key, so it can never verify a real signature. Use it to check that your client parses a JWKS document correctly, not to validate real tokens.

Sources

FAQ

Can I verify real tokens with this key?: No. The RSA key is illustrative and there is no matching private key, so nothing can produce a signature it would validate. Use it to test JWKS parsing and caching, not signature verification.
How do I test key rotation?: Add a second entry to the keys array with a different kid, then edit the mock to remove the first. A client that caches the key set indefinitely will keep failing after the removal — which is the bug this test is meant to expose.
What happens if a token references an unknown kid?: A correct client refetches the key set once, then rejects the token if the key is still absent. Serving a set that lacks the expected kid is the cleanest way to check your client does not loop or crash.

Ready to use it?

Open it in the mock builder to tweak first

Pairs well with this guide: Mock a REST API endpoint

Related templates

← All templates

Last updated: 2026-10-17