file · tool

GPG

GNU Privacy Guard

The most common OpenPGP implementation - the gpg command. GPG the tool, OpenPGP the format.

Take a token apart to see this in a real artifact, or read the rest of the glossary. No account is needed for either.

Reference

URL or embedded key?

Your app needs the public key to check a token. It can fetch it from a URL at runtime, or carry it as a file. Both are normal. The trade is always the same one: who controls rotation.

	Fetch from the URL	Embed the key
Rotation	Automatic on next fetch	Needs a redeploy
Network	Depends on the URL	None
Trust	Whatever the endpoint serves	Pinned to one key
Suits	A signer that rotates keys	Offline, air-gapped, or pinned

Use the URL when the signer rotates its keys, which is what every identity provider does. That is why it became the norm, and it is usually a one-line config change.

Embed the key when you cannot make a network call while checking a token, or when you want your app pinned to one key so a compromised endpoint could not introduce another. Export the PEM from the Keysets tab.

One catch worth knowing: Spring Boot's public-key-location only loads RSA keys. An ES256 or EdDSA key needs a custom decoder, or the URL.