# Manage the JWKS URI on Confluent Cloud
You need to manage the JSON Web Key Set (JWKS) URI of your OAuth identity
provider to:
* Ensure that the public keys used to verify the signatures of JSON Web Tokens
(JWTs) are up to date. Follow the steps below to manually refresh the JWKS URI
if the automatic refresh fails or if you rotate the public keys.
* If your identity provider is behind a firewall, verify network access to your
JWKS URI at least every three months.
## Refresh the JWKS URI of an OAuth identity provider
You can manually refresh the JWKS URI of your OAuth identity provider using
either the Confluent Cloud Console or the Confluent Cloud REST API to:
- Force immediate application of rotated public keys.
- Recover from automatic refresh failures.
**Refresh Frequency Settings**
The `max-age` directive in the `Cache-Control` header of the JWKS URI response
determines how often keys are refreshed. The value for `max-age` is specified in
seconds. Confluent Cloud observes the following values:
- **Minimum**: `300` (5 minutes)
- **Maximum**: `604800` (7 days)
- **Default**: `86400` (24 hours), used when `max-age` is not specified.
**Note**: A `max-age` value below the minimum is automatically set to `300`,
while a value above the maximum is capped at `604800`. To increase refresh
frequency, set a lower `max-age` value in your `Cache-Control` header.
**Example**: To set a 1-hour (3600 seconds) refresh frequency, the `Cache-Control`
header should be:
```text
Cache-Control: max-age=3600
```
If the JWKS URI is temporarily unavailable, the system continues using the
cached keys until the next successful refresh. In prolonged outages, you might
need to manually refresh the JWKS URI using the procedure below once connectivity
is restored.
### Confluent Cloud Console
Use the Confluent Cloud Console to manually refresh the JWKS URI
To manually refresh the JWKS URI of your OAuth identity provider:,
1. Sign in to the Confluent Cloud Console and go to the **Workload identities** tab
on the **Accounts & access** page at [https://confluent.cloud/settings/org/workload_identities](https://confluent.cloud/settings/org/workload_identities).
2. Click the identity provider you want to refresh. The details page appears.
3. Click **Edit** (icon) and then click **Refresh JWKS keys**.
The refresh operation proceeds and the identity provider details page appears.
### REST API
Use the Confluent Cloud REST API to manually refresh the JWKS URI
To use the Confluent Cloud REST API to make a request to refresh the JWKS URI,
see [Refresh a provider’s JWKS](https://docs.confluent.io/cloud/current/ccloud/refresh-iam-v-2-json-web-key-set/).
## Verify network access to the JWKS URI
If your identity provider is behind a firewall, you should verify network
access from Confluent Cloud to your identity provider using the public IP addresses
at least every three months to ensure that Confluent Cloud can access your Confluent Cloud
JWKS endpoint over the internet. Contact your identity provider to add new
Confluent Cloud public IP addresses to your firewall allowlist.
You can view the available Confluent Cloud public IP addresses on the [Confluent Cloud Console](https://confluent.cloud/).
Navigate to **Accounts and access** -> **Workload identities** tab.
