Platform public keys for verifying ID Token signatures.

Platforms publish their public keys at a key set URL. Ltix gets the keys it needs to verify a launch from a key set that your application starts.

Setup

Add a key set to your application's supervision tree.

# lib/my_app/application.ex
children = [
  Ltix.JWT.KeySet
]

To run more than one, or to choose the name, pass :name and set the name in your config.

children = [
  {Ltix.JWT.KeySet, name: MyApp.LtiKeys}
]

config :ltix, key_set: MyApp.LtiKeys

You can also choose the key set for one call.

Ltix.handle_callback(params, state, key_set: MyApp.LtiKeys)

Keys

A platform's keys are kept for the number of seconds in its cache-control: max-age, or 5 minutes without one. A key the platform has rotated in is available on the first launch signed with it.

Fetch limit

Each key set URL is fetched at most once every 30 seconds, however many launches arrive and whatever key IDs they have. Change the 30 seconds with the :refetch_interval option of start_link/1. After a failed fetch, launches for that platform return its error until the interval has passed.

A fetch retries a temporary failure up to three times. Pass retry: false in :req_options to disable retries.