Show HN: Secure Bearer JWT and JWKS pattern for headless AI agents (MCP #824)

Mawyxxstarted this conversation in

Show and tell

Pre-submission Checklist #

What would you like to share?## Security: Bearer JWT + JWKS for agent callers (no master secret in the LLM path)Headless agents calling MCP tools usually get one of two defaults — both fail a serious threat model: #

That’s what ## Static key vs human OAuth vs JWKS passport

Minimal wire #

Agent host:     opaque mint secret (env / secret manager)  →  never sent to MCP
Agent → LIME:   mint RS256 JWT { aud=mcp, domain=<mcp-host>, TTL≈minutes }
Agent → MCP:    Authorization: Bearer <jwt>
MCP RS:         JWKS verify → authorize by sub

Gate behind env ( If static keys already match the threat model, ignore. If agent auth is heading into review, this is the pattern that usually survives it. ## Relevant Links |