Skip to content

M2M.authenticate_token() blocks event loop on JWKS fetch #312

Description

@vladislavkoz

Not 101% sure that this observation is correct, but please review 🙏 .

M2M.authenticate_token() lacks an async version and blocks the event loop when PyJWKClient fetches JWKS keys. The Sessions API correctly handles this with asyncio.to_thread(), but M2M does not.

The docstring for M2M.authenticate_token() states:
"Note: There is no async version of this since we make no network calls."

This blocks the async event loop, causing latency spikes in async applications.

M2M.authenticate_token() # stytch/consumer/api/m2m.py:111
→ jwt_helpers.authenticate_jwt_local() # stytch/shared/jwt_helpers.py:37
→ jwks_client.get_signing_key_from_jwt() # jwt/jwks_client.py:200
→ get_signing_key() # jwt/jwks_client.py:185
→ get_signing_keys() # jwt/jwks_client.py:160
→ get_jwk_set() # jwt/jwks_client.py:136
→ fetch_data() # jwt/jwks_client.py:107-111
→ urllib.request.urlopen() # ❌ BLOCKING

  • Stytch version: 15.0.0
  • Python version: 3.13

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions