Your app needs the public key to check a token. It can fetch it from a URL at runtime, or carry it as a file. Both are normal. The trade is always the same one: who controls rotation.
| Fetch from the URL | Embed the key |
|---|
| Rotation | Automatic on next fetch | Needs a redeploy |
| Network | Depends on the URL | None |
| Trust | Whatever the endpoint serves | Pinned to one key |
| Suits | A signer that rotates keys | Offline, air-gapped, or pinned |
Use the URL when the signer rotates its keys, which is what every identity provider does. That is why it became the norm, and it is usually a one-line config change.
Embed the key when you cannot make a network call while checking a token, or when you want your app pinned to one key so a compromised endpoint could not introduce another. Export the PEM from the Keysets tab.
One catch worth knowing: Spring Boot's public-key-location only loads RSA keys. An ES256 or EdDSA key needs a custom decoder, or the URL.