How to set kid header claim in jwt from RSA private key?

Question

I want to generate a JWT token with "kid" header claim. I have a RSA private key in XML format to sign the JWT token. But in my JWT, I can not find "kid" header claim along with type and alg. How can I do this?

Here is the code to generate JWT token:

public async Task<IActionResult> Generate()
{
    var rsa = RSA.Create();
    string key = await System.IO.File.ReadAllTextAsync(options.PrivateKeyFilePath);
    rsa.FromXmlString(key);

    var credentials = new SigningCredentials(new RsaSecurityKey(rsa), SecurityAlgorithms.RsaSha256);

    var jwt = new JwtSecurityToken(
        new JwtHeader(credentials),
        new JwtPayload(
            "webapi",
            "webapi",
            new List<Claim>(),
            DateTime.UtcNow,
            DateTime.UtcNow.AddHours(3)
        )
    );

    string token = new JwtSecurityTokenHandler().WriteToken(jwt);

    return Ok(new { Token = token });
}

Here is my RSA private key.

<RSAKeyValue>
<Modulus>yRfxNTDYqxjEgow6HHBPBEiK6NrVCyLFpG8dklP7f7kFuKZozHopqnly/24Gf6jt9xYLFIsQhhRcuclzEKNnBcWzKlXg9xRwk0o2JzPCh1Ifn1XQ67FrD8+HlBT9DfxjkvzCkPLxi8UWxgifIGauVeFbhIOkVfS0JrIJyQI33sUmiciBGXnO9CjEUpiBcoY53CRa49aUBoKJFDuHV2zuPWCEHLYXrP8Ns15jRU70V/YYUzU3R3PnWk3ZA/12YqtMAJaXFE33DQE71Ccd6HsXfUJpJAM81O/pDPDsk3b3260eN20nLDT0F2acOYQb/3bVKzqZ97isZYqekkmXdeuy4Q==</Modulus>
<Exponent>AQAB</Exponent>
<P>5iuGQcTqCvpwII6EOr1+F98GviZ/PWtHoDkiP8ZiSVCH8XEYCiuPmuWBtOYlv+hLJ9zWUVPkD5uIatLttT6ZxCi7oP+A6htgTbRyLN4NAibwtfQAKQOtue98HyIE6J17OPu8EVBXUSL9rC98OxcbxqDPLOX0geWoIt8BIE9v5js=</P>
<Q>36kW0+j+wHZyx6weriPO5xBAdYBmrd04rSM2hNEZETHMm30JzSYdfU3HATGYiCwexXGlioRMM6xm84DHkWo3Abqaeou2JRFR7PD3UTnsvYBxFxlTd4RfRcNvdvZHFkN4U1sik0FkYbSit6zGU2agEaegp5Jt0vT+CeDonMrUjZM=</Q>
<DP>INPGUy0FgElVop8Q5tvN1xO8/3O4JAdf8M8VPmlJ7VDqAppxpkmuMpZXGHjWm3dC+M17V6ASX9N78lhhBL+H6L0yfXTTaxA6fPqmahXFXzA0lo7VUwQuS92HI12Tu6VyRJ9KpGGEApNuAJfJLRhPotWelrW5WKlrgIWzwGrz968=</DP>
<DQ>A/1PI+6HBMXYHEmsrmyDF0oJ7E6jBjzo8uWq5kmYid76iFd9okQoyIBnqVTKJLusvNbfHg5oEY/ksjk81hIv8v7yHHd7g0PA01ok/zTqTSMKYWAZRgt9a5Al39hawkHn1ozMnBXRhZCkSmRxkTFGb6ouym5pORcXpPN3Erznd7M=</DQ>
<InverseQ>IOdFLHWNtVoAMGAp1wuHWqXIv0BnLnJSce7h+iwm3e165oiszxYa/k/UrMam8qlbjESBZM43oJwGyXtBFVjdTNxyugw5rF04xgrDtMjqb/ZxK1mdoidL15Ij/NZpbd5HtVZ8nzf38wRvMYIzZSA06/V5cYI2molR6gMcWEaClJw=</InverseQ>
<D>N1dzdmP+/PdP/W2CAJmX5WHheLvgrbPgGKTLyp16NWhB/tMtPDjShqvtzgYFm9RtyPY0Dm9HGN85tZePJyERFTGXYStJQjZJ1P8zcA56lqsvMLZ5TKQDBtLiSQqNqe+vp6AQG7wAZarT3aQ5xrz7dX8TpKBl9ZHmkk+lCcCmh5PVZYaRhYTfJp1vONjKKA1L/ivOxKKmjcQnky/A0Po24d8lI5iBLaCco6dThZqvDdfhbudkFnbTDIsb0K/NEqTlC9/XH59CKSUU+jwNY2B1P9MUodmqdi5sce3OIw9sffPcBaSypLiCEH8IvAFyZCWFuxR6zdSBOyQrfu4KNfcNEQ==</D>
</RSAKeyValue>

Answer 1

The kid can be set with the SecurityKey.KeyId property:

...
var rsaSecurityKey = new RsaSecurityKey(rsa);
rsaSecurityKey.KeyId = "your kid";
var credentials = new SigningCredentials(rsaSecurityKey, SecurityAlgorithms.RsaSha256);
...

With this, the first part of the generated token is Base64url decoded:

{"alg":"RS256","kid":"your kid","typ":"JWT"}