Is your feature request related to a problem? Please describe.

When using JWKS based client authentication you provide a JWT token as assertion that gets verified by Hydra after which it issues an access token for the client. Hydra doesn't provide a nice error message to the client when the JWT token assertion has expired, instead it returns in internal server error.

**Describe the solut

Is your feature request related to a problem? Please describe.

The public key-based request signing functionality added to sso_proxy in buzzfeed/sso#106 is undocumented. In particular, it's not immediately obvious how to a) generate an appropriate keypair or b) validate a signed request in an upstream service.

Describe the solution you'd like

New documenta

If I am correct then currently no (prometheus) metrics are provided.

Was wondering what is the reason? Is there is any plan to implement them?

I know I would like to see some metrics about how many users are authenticated, how many redirected to 'login' page, for how many authentication fails etc

Not seeing how I'd be able to do that. the step certificate create -csr seems to expect to create a new private key