- Go 100%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
c889ff5cc5Ryujinx-Nextendo ManagerServer.cs hardcodes kid=`nextendo-baas-key-1` when signing id_tokens. The JWKS server default was `baas-key-1`, so new-account id_token verification fetched the JWKS but found no matching key → error 2124-3121 on every new Switch/Ryujinx login. Change default to `nextendo-baas-key-1` so tools that rely on the env-default (dev envs, prelude-server local variants, compose files) just work out of the box. |
||
| .gitignore | ||
| go.mod | ||
| LICENSE.md | ||
| main.go | ||
| README.md | ||
baas-jwks
Serves the JWK Set that lets a client verify a BAAS id_token signature.
Part of the Nextendo Network stack. Some titles locally verify the
account (BAAS) id_token before allowing online entry: they fetch the JSON Web Key Set from the
token's jku URL and check the RS256 signature against the matching public key.
baas-jwks answers that fetch. It publishes the public JWK derived from the RSA key the client
signs its id_token with (the kid matches the token header). It ships no private key — the
signing key is supplied to the signer separately, at runtime. Every other path is logged and 404'd.
Configuration is through environment variables; no secrets or infrastructure addresses are baked in.
License
Released under the PolyForm Shield License 1.0.0 — source-available.