Im trying to implement private_key_jwt client authentication in spring authorization server (oauth2). But im having trouble implementing signature verification. From what i see i have to specify “JwkSetUri”, since this part of code is throwing an exception

clientSecret = registeredClient.getClientSettings().getJwkSetUrl(); //This is null

So i have 2 questions. Is client supposed to expose this JwkUri endpoint so authorization server can fetch public key from it? And if so can i maybe do it without exposing an andpoint and somehow load the key from file?

I tried to find a solution but seems like there is only one jwt decoder implemented by spring authorization server and its requiring a jwk-uri and coding totaly seperate decoder seems like overkill.