Each key has a kid that the token header names, which makes key rotation possible without changing the clients.
JWKS
A JSON document, usually at /jwks.json, that publishes the public keys used to verify an issuer's signed tokens.
Each key has a kid that the token header names, which makes key rotation possible without changing the clients.