Currently, JWT access tokens are signed with SH256 algorithm (the default one provided by jsonwebtoken.sign method). Since most Identity Providers use RS256, and this algorithm is more supported by libraries such as Spring Security OAuth 2.0 Resource Server, I think an option for RS256 should be offered. I've implemented such a modification myself, and I'm making a pull request just after opening this issue.