Guides

Written up in one place

What the bench is for, and the failures it exists to catch, at more length than a panel allows. No account needed to read these.

12 August 2026

Why a JWT fails to verify

A verification failure has four possible layers - structure, key resolution, signature and freshness - and the error message rarely says which one.

5 August 2026

Testing a signed webhook before the sender exists

The counterparty holds the private key, so their payloads cannot be produced locally. Standing in for them turns a blocked integration into an ordinary one.

Reference

URL or embedded key?

Your app needs the public key to check a token. It can fetch it from a URL at runtime, or carry it as a file. Both are normal. The trade is always the same one: who controls rotation.

	Fetch from the URL	Embed the key
Rotation	Automatic on next fetch	Needs a redeploy
Network	Depends on the URL	None
Trust	Whatever the endpoint serves	Pinned to one key
Suits	A signer that rotates keys	Offline, air-gapped, or pinned

Use the URL when the signer rotates its keys, which is what every identity provider does. That is why it became the norm, and it is usually a one-line config change.

Embed the key when you cannot make a network call while checking a token, or when you want your app pinned to one key so a compromised endpoint could not introduce another. Export the PEM from the Keysets tab.

One catch worth knowing: Spring Boot's public-key-location only loads RSA keys. An ES256 or EdDSA key needs a custom decoder, or the URL.