OptionaljwksOptionalfetchCustom fetch. Defaults to globalThis.fetch resolved at call time.
OptionalcacheHow long a fetched key set is reused, in milliseconds. Defaults to one hour.
OptionalrefetchMinimum gap between two fetches triggered by an unknown kid, in
milliseconds, so made-up key ids cannot hammer SSO. Defaults to one minute.
OptionalnowClock override for tests, epoch milliseconds.
Key set URL. Defaults to DEFAULT_SSO_JWKS_URL.