Allow custom KID/JWK for ID and access token signing

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe your problem

I would like to use a different signing algorithm than what is used in hydra.jwt.access-token and hydra.openid.id-token for a specific client.

Describe your ideal solution

It would be nice to have a kid or signing_jwk option in the client config JSON to define which JWK should be used to sign this specific clients ID and access tokens.

I already created a custom JWK via /admin/keys/my.custom.name.

Just an option to use this key for signing in a specific client is needed.

Workarounds or alternatives

I did not find any alternatives or workarounds.

Version

v2.3.0

Additional Context

No response

Start by tracing how hydra.jwt.access-token and hydra.openid.id-token select signing keys, then inspect the client config and the /admin/keys/my.custom.name endpoint. Define how a per-client kid or signing_jwk would be configured and applied to ID and access tokens. Done means a specific client can use its selected JWK without changing other clients' signing behavior.