feat: add support for asymmetrical url signing keys, auth style key rotation and well-known by itslenny · Pull Request #1257 · supabase/storage

itslenny · 2026-07-23T19:25:05Z

What kind of change does this PR introduce?

Feature

What is the current behavior?

Only supports symmetric (HMAC) url signing keys
No way to create standby keys or swap them (similar to how auth key rotation works)
No way to list tenant jwks
JWK/JWT includes the mutable kind as a prefix in the kid - this makes swapping keys problematic

What is the new behavior?

Remove kind prefix from kid
Support generating/using asymmetrical signing keys (ECDSA)
Add endpoints to support "auth style" key rotation
- Create standby signing keys
- Swap standby signing keys to active (used to sign URLs via api)
- List jwks
Add public .well-known/jwks.json so asymmetric keys can be validated at the gateway

coveralls · 2026-07-23T19:31:16Z

Coverage Report for CI Build 32506509059

Coverage increased (+0.2%) to 81.408%

Details

Coverage increased (+0.2%) from the base build.
Patch coverage: 5 uncovered changes across 3 files (129 of 134 lines covered, 96.27%).
No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
src/storage/events/jwks/jwks-create-signing-secret.ts	2	0	0.0%
src/test/utils/config-change-awaiter.ts	12	10	83.33%
src/internal/auth/jwks/manager.ts	26	25	96.15%
Total (13 files)	134	129	96.27%

Coverage Regressions

No coverage regressions found.

Coverage Stats


Relevant Lines:	13228
Covered Lines:	11202
Line Coverage:	84.68%
Relevant Branches:	7835
Covered Branches:	5945
Branch Coverage:	75.88%
Branches in Coverage %:	Yes
Coverage Strength:	603.57 hits per line

💛 - Coveralls

ferhatelmas · 2026-08-13T23:05:50Z

          UPDATE tenants_jwks
          SET active = $1
          WHERE id = $2
            AND tenant_id = $3
            AND active = $4


per state machine, it won't be called concurrently or on signing key but shall we add kind to filter to ensure standby?

This can be called on a key of any kind. It is used in rollURlSigningJwk to deactivate the active key. It can also be used to deactivate custom keys that were added which can have any kind (except the reserved ones). Since the kid is unique (primary key) there is no concern of updating the wrong key.

This did make me realize that it's possible to deactivate the current url signing key which would leave the tenant with no url signing key at all. I added a check at the endpoint layer to explicitly prevent this. We can still use the roll endpoint and from an end user perspective they should create a standby, swap, and then deactivate

exactly, this was my concern

I rechecked this, endpoint check can only protect serial calls. If toggleActive is blocked on row lock of concurrent roll, it can deactivate the single signing key. We still need the kind check here to prevent it

…otation and well-known

itslenny requested a review from a team as a code owner July 23, 2026 19:25

This comment has been minimized.

Sign in to view

This comment was marked as outdated.

Sign in to view

itslenny force-pushed the lenny/jwks-support-standby-key-and-asymmetric-keys branch 5 times, most recently from 868168d to 385ef32 Compare July 29, 2026 19:31

depthfirst-app Bot reviewed Jul 29, 2026

View reviewed changes

Comment thread src/internal/auth/jwks/store-pg.ts

itslenny force-pushed the lenny/jwks-support-standby-key-and-asymmetric-keys branch from 385ef32 to 81b3ff4 Compare July 31, 2026 21:05

depthfirst-app Bot reviewed Jul 31, 2026

View reviewed changes

Comment thread src/storage/events/jwks/jwks-roll-url-signing-key.ts Outdated

itslenny force-pushed the lenny/jwks-support-standby-key-and-asymmetric-keys branch 3 times, most recently from 911b0a0 to 22eead5 Compare August 4, 2026 20:47