Better Auth JWKS Cookie Cache
Better Auth 1.7 session cookie cache signed with the jwt() plugin's asymmetric keyring instead of the server secret, so an edge worker or a separate service can verify a session from the public JWKS with no database round trip and no ability to mint sessions. Includes the betterAuth() config (strategy "jwt", signingKey "jwt-plugin", secure cookie prefix, boot-time secret check) and an edge reader that fetches and TTL-caches the JWKS, pins the issuer and audience claims, serves a stale keyring through auth-server blips, and documents the revocation lag the cookie cache carries.
npx shadcn@latest add @compronents/better-auth-jwks-cookie-cacheInstalls from ui.aryank.space. Needs a registry token and a one-time @compronents entry in components.json. The docs walk through both.
Every request that verifies a JWT first fetches the JWKS over the network, so the auth server sits in the hot path of every page load. Auth added a round trip to everything, and when the auth server blips, every verify blips with it.