EN-1685: Use the more standard "kid" to define which key is being used (#3234)

djeebus · claude · web-flow · commit 07df385b2b84 · 2026-07-14T13:38:01.000-07:00
Co-authored-by: Claude &lt;noreply@anthropic.com&gt;
diff --git a/packages/api/internal/handlers/volume_token.go b/packages/api/internal/handlers/volume_token.go
@@ -49,6 +49,9 @@ func generateVolumeContentToken(config cfg.VolumesTokenConfig, volume queries.Vo
 	}
 
 	token := jwt.NewWithClaims(config.SigningMethod, claims)
+	// `kid` is the standard header verifiers use to select a key from a JWKS;
+	// `tokid` is kept for backwards compatibility.
+	token.Header["kid"] = config.SigningKeyName
 	token.Header["tokid"] = config.SigningKeyName
 	signedToken, err := token.SignedString(config.SigningKey)
 	if err != nil {

Original file line number	Diff line number	Diff line change
`@@ -49,6 +49,9 @@ func generateVolumeContentToken(config cfg.VolumesTokenConfig, volume queries.Vo`
`49`	`49`	`}`
`50`	`50`
`51`	`51`	`token := jwt.NewWithClaims(config.SigningMethod, claims)`
	`52`	+ // `kid` is the standard header verifiers use to select a key from a JWKS;
	`53`	+ // `tokid` is kept for backwards compatibility.
	`54`	`+ token.Header["kid"] = config.SigningKeyName`
`52`	`55`	`token.Header["tokid"] = config.SigningKeyName`
`53`	`56`	`signedToken, err := token.SignedString(config.SigningKey)`
`54`	`57`	`if err != nil {`