How often does Salesforce change the keys change at https://login.salesforce.com/id/keys ?


  • A client wants to verify the JWT signature generated for Salesforce's OpenID Connect token
  • However, the client application is unable to call out to the JWKS endpoint (https://login.salesforce.com/id/keys) to retrieve the public keys at runtime
  • As an alternative to this, they're looking at storing these public keys locally on the client application server and manually fetching the new keys whenever Salesforce rotates them


  1. Is this approach viable?
  2. If so, how often would the client need to manually fetch new keys from the JWKS endpoint?
  3. Is there an alternative approach I'm missing here?


  • These keys are rotated for every release. Trying to find salesforce doc.The "kid" parameter corresponds to Salesforce's internal number of releases, so right now it's 234, 236, and 238. Commented Apr 21, 2022 at 14:44
  • 1
    The keys can be rotated any time. Answer to all 3 questions: stackoverflow.com/questions/67122035/…
    – identigral
    Commented Apr 21, 2022 at 15:02
  • @Swetha That is undocumented afaik...and perhaps it should stay undocumented. Client apps should not assume frequency to avoid being broken.
    – identigral
    Commented Apr 21, 2022 at 15:08
  • Thank you both for these helpful responses.
    – Rob
    Commented Apr 21, 2022 at 15:33

1 Answer 1


I cross-posted this question to https://trailhead.salesforce.com/en/trailblazer-community/feed/0D54S00000GzB9Z and received the following answer from Sam Rosen, a Director on the Salesforce Identity Product Management team:

Today this key is rotated with every release (so it is rotated 3 times a year with the summer, winter, and spring releases). The approach can work, and I am not sure of an alternative approach.

However we cannot guarantee that we will not rotate this key for some unknown reason in the middle of a release without notice, similarly we cannot guarantee that we will not one day decide to start rotating the key more regularly without notice.

With this in mind, if the integration ever started throwing errors, one of the first things you would want to do is check if the keys have changed at the keys endpoint.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .