About this question
I build a third-party application that integrates with Salesforce using the REST API (connected app). We hit /services/oauth2/token to get a token for the user, then we verify the token using the associated RSA key from https://login.salesforce.com/id/keys. Here's the problem. In the past two months, we've started to get intermittent failures. You'll notice if you go to https://login.salesforce.com/id/keys and then refresh the page a couple times, you get random responses. You can tell by looking at the "kid" fields in the JSON. Often "kid": "222" is not present, for instance. Is this expected from this endpoint? I would assume not seeing as we only started getting errors from this in the past two months when we've had this integration for a couple years. I've also noticed that hitting the /id/keys endpoint from an org-specific domain like https://na49.lightning.force.com/id/keys always returns a consistent result, but never includes "kid": "228" like https://login.salesforce.com/id/keys sometimes does. So is it safe to use the org-specific domain since it's consistent? Or does my server need to handle the inconsistency in order to support "kid": "228"?
