Is there a plan to support jwt sign with kid in header

[byn9826]

Currently the header of jwt sign is fixed, and consist of { alg, typ: 'JWT' }

hono/src/utils/jwt/jwt.ts

Line 53 in f9a23a9

const encodedHeader = encodeJwtPart({ alg, typ: 'JWT' } satisfies TokenHeader)

To support adding kid in the header during signing, I’ve had to copy all the helper functions from Hono’s JWT sign functionality, allowing me to set kid in the header manually. This approach is definitely not super clean and duplicating codes:
https://github.com/ValueMelody/melody-auth/blob/main/server/src/services/jwt.ts#L52

Since including kid in the JWT header is a common practice when signing tokens with RS256, I’m wondering if there are any plans to officially support it directly in Hono’s JWT sign function.

[ssadel]

bump, need this for sign in with apple server side validation

[DevTurpGL]

I'd like this, too. Surprised it wasn't added in the beginning.

[AnuroopSuresh]

any update on this?

[agammann]

This is supported in Hono 4.13.13. sign() includes kid in the JWT header when the signing key is a JWK carrying alg and kid:

import { sign } from 'hono/jwt'

const privateJwk = await crypto.subtle.exportKey('jwk', privateKey)
privateJwk.alg = 'RS256'
privateJwk.kid = 'key-1'

const token = await sign({ sub: 'user-123' }, privateJwk, 'RS256')

I ran this with an RSA key pair on hono@4.13.13. The decoded header was {"alg":"RS256","typ":"JWT","kid":"key-2026-10"}, and verify() with the matching public JWK returned the original payload. So you no longer need to copy Hono's JWT helper solely to set kid.