How is the public key transmitted in JSON Web Token?

In JSON Web Token (JWT), the public key is usually not transmitted directly inside the token itself. Instead, the JWT is signed with a private key, and the corresponding public key is used to verify the signature, which should be accessible to the party verifying the token.

To transmit the public key, the following approaches are often used:

• JWKS (JSON Web Key Set) — a special JSON document containing a set of public keys, accessible via a URL. Clients or services can obtain this document and use the appropriate key to verify the JWT signature.
• Including the key in the JWT header — in the kid (key ID) field, the identifier of the key is specified so that the recipient knows which key to use from the JWKS.

Example of a JWT header with kid:

{
  "alg": "RS256",
  "typ": "JWT",
  "kid": "12345"
}

Thus, the public key is not transmitted within the JWT itself but is provided separately (for example, via JWKS), and the token indicates a link or identifier for selecting the key.