SAMPLE JWK — Symmetric oct Key
The symmetric HMAC secret used by this wave's HS256 tokens, expressed as an oct JWK. The secret is printed in the specs on purpose so a verifier can be wired up without guessing.
{
"kty": "oct",
"use": "sig",
"alg": "HS256",
"kid": "novus-p7-hmac-2026",
"k": "bm92dXMtcDctc2FtcGxlLWhtYWMtc2VjcmV0LW5vdC1hLXJlYWwta2V5"
}
Specifications
- Kty
- oct
- Alg
- HS256
- Secret Bytes
- 42
- Secret
- novus-p7-sample-hmac-secret-not-a-real-key
- Warning
- published sample secret — never use for a real identity
- Sample Only
- true
- Seed
- 70117
Testing contract
Reference control- Scenario
- Load the oct JWK and verify the p7 HS256 token with it.
- Expected result
- The base64url k value decodes to the published secret and the HS256 signature verifies.
What is a .json file?
JSON (JavaScript Object Notation) is a lightweight, text-based data-interchange format representing objects, arrays, strings, numbers, booleans, and null. It is language-independent, human-readable, and the dominant format for web APIs and configuration. It requires a single well-formed root value.
How to use this file
Use an example JSON file to test parsers and serializers, schema validation, Unicode and number-precision handling, and API request or response processing.
How to use this file for testing
“SAMPLE JWK — Symmetric oct Key” is a deterministic Novus Examples fixture for JWT / JWKS testing. Unsigned and SAMPLE-signed JWT variants plus JWKS documents — published sample material only, for auth parser tests.
Documented properties for this file: seed 70117. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
This is published, SAMPLE-only security material — never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.
These JSON fixtures are synthetic SAMPLE auth or tool-call shapes for harnesses — never production secrets or live tokens. Validate schema fields and alg variants against the documented role.
Code examples
import json
with open("jwk-oct-hmac.json") as f:
data = json.load(f)
print(type(data), len(data))Related files
- jsonJWKS (Empty Keys) — SAMPLEEmpty JWKS keys array for edge-case JWKS loaders.
- jsonJWKS (RSA) — SAMPLESAMPLE JWKS document exposing the Wave G RSA public key for JWT signature verification tests.
- jsonSAMPLE JWKS — Duplicate kidTwo keys of different types published under the same kid — what a botched key rotation leaves behind. A resolver that returns the first match silently verifies against the wrong key type instead of reporting the ambiguity.
- jsonSAMPLE JWKS — Keys Without kidA JWK Set whose keys carry no kid at all, which RFC 7517 permits. Verifiers must then fall back to trying candidates by algorithm, and the ones that index the set by kid alone find nothing.
- jsonSAMPLE JWKS — RSA, EC, and Ed25519 KeysA three-key JWK Set publishing the public halves of this wave's RSA, P-256, and Ed25519 keys, each with a distinct kid. It is the resolver input for every p7 JWT, so kid selection can be tested against a set that really has more than one candidate.
- jsonSAMPLE JWKS — With x5c Certificate ChainA JWK carrying the full x5c certificate chain and an x5t#S256 thumbprint alongside the raw n/e values. The x5c array is standard Base64 while every other JWK field is base64url — a real and frequently mis-implemented detail.
Generated by generation/security_p7.py. Free for any use, no attribution required — license.