idToken from getAuthTokenInfo() has iss="web3auth.io" and a kid that is not in any published JWKS (sapphire_devnet, @web3auth/modal 11.4.0)

Embedded Wallets (Web3Auth)
1

## Summary

Server-side verification of the identity token fails because the token returned by

getAuthTokenInfo() is signed with a key that is not published in any JWKS endpoint we can

find, and its `iss` claim does not match the documented value.

We would like to know which JWKS endpoint serves this key, or what we are doing wrong.

## Questions

1. Which JWKS endpoint serves the key with

kid = 5Imw8N7KYnswBTF09jMFz8OzgQF8jZSaOQ1buVP5x14 ?

2. Why is iss “web3auth.io” rather than the documented “https://api-auth.web3auth.io”?

Is this expected on sapphire_devnet? The dashboard warns that "Devnet undergoes

periodic key rotations" - is the devnet signing key intentionally not published on the

production JWKS endpoint?

3. Would a sapphire_mainnet project return a token with the documented iss and a kid that

is present in https://api-auth.web3auth.io/jwks ?

4. In @web3auth/modal 11.4.0, is getAuthTokenInfo() the correct way to obtain the

backend-verifiable identity token? The docs reference getIdentityToken(), which is not

present in this version.

5. For Sapphire (MPC), which wallets[] entry corresponds to the EVM address returned by

the EIP-1193 provider - web3auth_app_key or web3auth_threshold_key? We need this to

match a personal_sign signature against the correct public key.

Thank you.

2

Hi there,

  1. JWKS: For kid=5Imw8N7..., use the v11 Citadel JWKS:
    https://api.web3auth.io/citadel-service/.well-known/jwks.json
    — not api-auth.web3auth.io/jwks.
  2. Issuer: iss: "web3auth.io" is expected with the v11 token flow. The documented https://api-auth.web3auth.io issuer/JWKS is outdated for this flow.
  3. Mainnet: Don’t assume Sapphire mainnet will use the old issuer/JWKS either; v11 can use the Citadel issuer/key infrastructure.
  4. getAuthTokenInfo(): Yes. In @web3auth/modal v11, this replaces the older getIdentityToken() API.
  5. EVM wallet: For matching the EIP-1193 EVM address/signature, use the wallets[] entry with:
    type: "web3auth_threshold_key" and curve: "secp256k1".

So your backend verification should essentially be:

getAuthTokenInfo()
       ↓
JWT
       ↓
JWKS: api.web3auth.io/citadel-service/.well-known/jwks.json
issuer: "web3auth.io"
       ↓
wallets[].type = "web3auth_threshold_key"

The documentation appears to lag behind the v11 implementation. Please let us know if you have any questions.