From d7699389bc14c604bac54eed9c403aed6f78ef95 Mon Sep 17 00:00:00 2001
From: Zoe Roux <zoe.roux@zoriya.dev>
Date: Mon, 1 Dec 2025 19:05:22 +0100
Subject: [PATCH] Fix missing `kid` in apikeys jwt

---
 auth/apikey.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/auth/apikey.go b/auth/apikey.go
index 851b6b90..339f8db7 100644
--- a/auth/apikey.go
+++ b/auth/apikey.go
@@ -211,6 +211,7 @@ func (h *Handler) createApiJwt(apikey string) (string, error) {
 		Time: time.Now().UTC().Add(time.Hour),
 	}
 	jwt := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	jwt.Header["kid"] = h.config.JwtKid
 	t, err := jwt.SignedString(h.config.JwtPrivateKey)
 	if err != nil {
 		return "", err