← All practicals

Watch a security event become a signed signal

Revoke a session and watch it turn into a signed SET, pushed to a receiver that checks it against the JWKS.

1. 1

   On the CAEP lab, step up with TOTP (or delete a passkey from the Account page).

   The Lab is an OpenID Shared Signals Framework TRANSMITTER: the moment your security posture changes, it builds a Security Event Token (RFC 8417) describing exactly that — no polling, no batching.

2. 2

   That SET is a real ES256 JWS, signed with the same key that backs the JWKS.

   CAEP (Continuous Access Evaluation Profile) defines the event vocabulary — session-revoked, credential-change, assurance-level-change — for exactly this: telling every relying party your session risk changed, right now, not at next token refresh.

3. 3

   Watch it land in the live signal stream below, signature verified.

   The receiver here is SIMULATED (same Worker, no network hop) but the verification is real: it checks the SET’s iss, aud and ES256 signature against the Lab’s own JWKS before ever trusting it — a tampered or wrong-key SET would fail exactly this check.