Yes. I'm afraid that will be necessary at the moment because: - We do not expose the JWKs in a format like auth0's - The JWT signing keys keep changing automatically (without logging anyone out) for enhanced security.