diff --git a/app/components/Header/AuthModal.client.vue b/app/components/Header/AuthModal.client.vue
index 437282b19..c77088de1 100644
--- a/app/components/Header/AuthModal.client.vue
+++ b/app/components/Header/AuthModal.client.vue
@@ -50,6 +50,14 @@ watch(handleInput, newHandleInput => {
     handleInput.value = normalized
   }
 })
+
+watch(user, async newUser => {
+  if (newUser?.relogin) {
+    await authRedirect(newUser.did, {
+      redirectTo: route.fullPath,
+    })
+  }
+})
 </script>
 
 <template>
diff --git a/modules/cache.ts b/modules/cache.ts
index a2e7c3a41..31df72a6b 100644
--- a/modules/cache.ts
+++ b/modules/cache.ts
@@ -4,6 +4,8 @@ import { provider } from 'std-env'
 
 // Storage key for fetch cache - must match shared/utils/fetch-cache-config.ts
 const FETCH_CACHE_STORAGE_BASE = 'fetch-cache'
+// Storage key for OAuth cache - must match server/utils/atproto/storage.ts
+const OAUTH_CACHE_STORAGE_BASE = 'atproto:oauth'
 
 export default defineNuxtModule({
   meta: {
@@ -37,6 +39,11 @@ export default defineNuxtModule({
           ...nitroConfig.storage[FETCH_CACHE_STORAGE_BASE],
           driver: 'vercel-runtime-cache',
         }
+
+        nitroConfig.storage[OAUTH_CACHE_STORAGE_BASE] = {
+          ...nitroConfig.storage[OAUTH_CACHE_STORAGE_BASE],
+          driver: 'vercel-runtime-cache',
+        }
       }
 
       const env = process.env.VERCEL_ENV
diff --git a/nuxt.config.ts b/nuxt.config.ts
index 5965c351e..cab22e8a4 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -34,6 +34,7 @@ export default defineNuxtConfig({
 
   runtimeConfig: {
     sessionPassword: '',
+    oauthJwkOne: process.env.OAUTH_JWK_ONE || undefined,
     // Upstash Redis for distributed OAuth token refresh locking in production
     upstash: {
       redisRestUrl: process.env.UPSTASH_KV_REST_API_URL || process.env.KV_REST_API_URL || '',
@@ -119,6 +120,7 @@ export default defineNuxtConfig({
     '/_avatar/**': { isr: 3600, proxy: 'https://www.gravatar.com/avatar/**' },
     '/opensearch.xml': { isr: true },
     '/oauth-client-metadata.json': { prerender: true },
+    '/.well-known/jwks.json': { prerender: true },
     // never cache
     '/api/auth/**': { isr: false, cache: false },
     '/api/social/**': { isr: false, cache: false },
diff --git a/package.json b/package.json
index 12ea115e5..ce7a6ad02 100644
--- a/package.json
+++ b/package.json
@@ -33,6 +33,7 @@
     "generate:sprite": "node scripts/generate-file-tree-sprite.ts",
     "generate:fixtures": "node scripts/generate-fixtures.ts",
     "generate:lexicons": "lex build --lexicons lexicons --out shared/types/lexicons --clear",
+    "generate:jwk": "node scripts/gen-jwk.ts",
     "test": "vite test",
     "test:a11y": "pnpm build:test && LIGHTHOUSE_COLOR_MODE=dark pnpm test:a11y:prebuilt && LIGHTHOUSE_COLOR_MODE=light pnpm test:a11y:prebuilt",
     "test:a11y:prebuilt": "./scripts/lighthouse.sh",
diff --git a/scripts/gen-jwk.ts b/scripts/gen-jwk.ts
new file mode 100644
index 000000000..39a2740c8
--- /dev/null
+++ b/scripts/gen-jwk.ts
@@ -0,0 +1,11 @@
+import { JoseKey } from '@atproto/oauth-client-node'
+
+async function run() {
+  const kid = Date.now().toString()
+  const key = await JoseKey.generate(['ES256'], kid)
+  const jwk = key.privateJwk
+
+  console.log(JSON.stringify(jwk))
+}
+
+await run()
diff --git a/server/api/auth/atproto.get.ts b/server/api/auth/atproto.get.ts
index 0ff4b2eaf..8ccff1f85 100644
--- a/server/api/auth/atproto.get.ts
+++ b/server/api/auth/atproto.get.ts
@@ -1,19 +1,16 @@
 import type { OAuthSession } from '@atproto/oauth-client-node'
-import { NodeOAuthClient, OAuthCallbackError } from '@atproto/oauth-client-node'
+import { OAuthCallbackError } from '@atproto/oauth-client-node'
 import { createError, getQuery, sendRedirect, setCookie, getCookie, deleteCookie } from 'h3'
 import type { H3Event } from 'h3'
-import { getOAuthLock } from '#server/utils/atproto/lock'
-import { useOAuthStorage } from '#server/utils/atproto/storage'
 import { SLINGSHOT_HOST } from '#shared/utils/constants'
 import { useServerSession } from '#server/utils/server-session'
-import { handleResolver } from '#server/utils/atproto/oauth'
 import { handleApiError } from '#server/utils/error-handler'
 import type { DidString } from '@atproto/lex'
 import { Client } from '@atproto/lex'
 import * as com from '#shared/types/lexicons/com'
 import * as app from '#shared/types/lexicons/app'
 import { isAtIdentifierString } from '@atproto/lex'
-import { scope, getOauthClientMetadata } from '#server/utils/atproto/oauth'
+import { scope } from '#server/utils/atproto/oauth'
 import { UNSET_NUXT_SESSION_PASSWORD } from '#shared/utils/constants'
 // @ts-expect-error virtual file from oauth module
 import { clientUri } from '#oauth/config'
@@ -28,17 +25,8 @@ export default defineEventHandler(async event => {
   }
 
   const query = getQuery(event)
-  const clientMetadata = getOauthClientMetadata()
   const session = await useServerSession(event)
-  const { stateStore, sessionStore } = useOAuthStorage(session)
-
-  const atclient = new NodeOAuthClient({
-    stateStore,
-    sessionStore,
-    clientMetadata,
-    requestLock: getOAuthLock(),
-    handleResolver,
-  })
+  const atclient = await getNodeOAuthClient(session, config)
 
   if (query.handle) {
     // Initiate auth flow
@@ -69,7 +57,10 @@ export default defineEventHandler(async event => {
       const redirectUrl = await atclient.authorize(query.handle, {
         scope,
         prompt: query.create ? 'create' : undefined,
-        ui_locales: query.locale?.toString(),
+        // TODO: I do not beleive this is working as expected on
+        // a unsupported locale on the PDS. Gives Invalid at body.ui_locales
+        // Commenting out for now
+        // ui_locales: query.locale?.toString(),
         state: encodeOAuthState(event, { redirectPath }),
       })
 
diff --git a/server/api/auth/session.get.ts b/server/api/auth/session.get.ts
index 771ab6c00..286d6489d 100644
--- a/server/api/auth/session.get.ts
+++ b/server/api/auth/session.get.ts
@@ -8,5 +8,17 @@ export default defineEventHandler(async event => {
     return null
   }
 
+  // A one time redirect to upgrade the previous sessions.
+  // Can remove in 2 weeks from merge if we'd like
+  if (serverSession.data.oauthSession && serverSession.data?.public?.did) {
+    await serverSession.update({
+      oauthSession: undefined,
+    })
+    return {
+      ...result.output,
+      relogin: true,
+    }
+  }
+
   return result.output
 })
diff --git a/server/routes/.well-known/jwks.json.get.ts b/server/routes/.well-known/jwks.json.get.ts
new file mode 100644
index 000000000..a76a955c8
--- /dev/null
+++ b/server/routes/.well-known/jwks.json.get.ts
@@ -0,0 +1,12 @@
+import { loadJWKs } from '#server/utils/atproto/oauth'
+
+export default defineEventHandler(async event => {
+  const config = useRuntimeConfig(event)
+  const keys = await loadJWKs(config)
+  if (!keys) {
+    console.error('Failed to load JWKs. May not be set')
+    return []
+  }
+
+  return keys.publicJwks
+})
diff --git a/server/routes/oauth-client-metadata.json.get.ts b/server/routes/oauth-client-metadata.json.get.ts
index 0ea235ed6..bd2a39349 100644
--- a/server/routes/oauth-client-metadata.json.get.ts
+++ b/server/routes/oauth-client-metadata.json.get.ts
@@ -1,3 +1,7 @@
-export default defineEventHandler(() => {
-  return getOauthClientMetadata()
+export default defineEventHandler(async event => {
+  const config = useRuntimeConfig(event)
+  const keyset = await loadJWKs(config)
+  // @ts-expect-error Taken from statusphere-example-app. Throws a ts error
+  const pk = keyset?.findPrivateKey({ use: 'sig' })
+  return getOauthClientMetadata(pk?.alg)
 })
diff --git a/server/utils/atproto/oauth-session-store.ts b/server/utils/atproto/oauth-session-store.ts
index 041e09719..9f862bf88 100644
--- a/server/utils/atproto/oauth-session-store.ts
+++ b/server/utils/atproto/oauth-session-store.ts
@@ -1,26 +1,47 @@
 import type { NodeSavedSession, NodeSavedSessionStore } from '@atproto/oauth-client-node'
 import type { UserServerSession } from '#shared/types/userSession'
 import type { SessionManager } from 'h3'
+import { OAUTH_CACHE_STORAGE_BASE } from '#server/utils/atproto/storage'
 
 export class OAuthSessionStore implements NodeSavedSessionStore {
-  private readonly session: SessionManager<UserServerSession>
+  private readonly serverSession: SessionManager<UserServerSession>
+  private readonly storage = useStorage(OAUTH_CACHE_STORAGE_BASE)
 
   constructor(session: SessionManager<UserServerSession>) {
-    this.session = session
+    this.serverSession = session
   }
 
-  async get(): Promise<NodeSavedSession | undefined> {
-    const sessionData = this.session.data
-    if (!sessionData) return undefined
-    return sessionData.oauthSession
+  private createStorageKey(did: string, sessionId: string) {
+    return `sessions:${did}:${sessionId}`
   }
 
-  async set(_key: string, val: NodeSavedSession) {
-    // We are ignoring the key since the mapping is already done in the session
-    try {
-      await this.session.update({
-        oauthSession: val,
+  async get(key: string): Promise<NodeSavedSession | undefined> {
+    const serverSessionData = this.serverSession.data
+    if (!serverSessionData) return undefined
+    if (!serverSessionData.oauthSessionId) {
+      console.warn('[oauth session store] No oauthSessionId found in session data')
+      return undefined
+    }
+
+    let session = await this.storage.getItem<NodeSavedSession>(
+      this.createStorageKey(key, serverSessionData.oauthSessionId),
+    )
+    return session ?? undefined
+  }
+
+  async set(key: string, val: NodeSavedSession) {
+    const serverSessionData = this.serverSession.data
+    let sessionId
+    if (!serverSessionData?.oauthSessionId) {
+      sessionId = crypto.randomUUID()
+      await this.serverSession.update({
+        oauthSessionId: sessionId,
       })
+    } else {
+      sessionId = serverSessionData.oauthSessionId
+    }
+    try {
+      await this.storage.setItem<NodeSavedSession>(this.createStorageKey(key, sessionId), val)
     } catch (error) {
       // Not sure if this has been happening. But helps with debugging
       console.error(
@@ -31,9 +52,16 @@ export class OAuthSessionStore implements NodeSavedSessionStore {
     }
   }
 
-  async del() {
-    await this.session.update({
-      oauthSession: undefined,
+  async del(key: string) {
+    const serverSessionData = this.serverSession.data
+    if (!serverSessionData) return undefined
+    if (!serverSessionData.oauthSessionId) {
+      console.warn('[oauth session store] No oauthSessionId found in session data')
+      return undefined
+    }
+    await this.storage.removeItem(this.createStorageKey(key, serverSessionData.oauthSessionId))
+    await this.serverSession.update({
+      oauthSessionId: undefined,
     })
   }
 }
diff --git a/server/utils/atproto/oauth-state-store.ts b/server/utils/atproto/oauth-state-store.ts
index d15a95e96..fbea36ad4 100644
--- a/server/utils/atproto/oauth-state-store.ts
+++ b/server/utils/atproto/oauth-state-store.ts
@@ -1,30 +1,45 @@
 import type { NodeSavedState, NodeSavedStateStore } from '@atproto/oauth-client-node'
 import type { UserServerSession } from '#shared/types/userSession'
 import type { SessionManager } from 'h3'
+import { OAUTH_CACHE_STORAGE_BASE } from '#server/utils/atproto/storage'
 
 export class OAuthStateStore implements NodeSavedStateStore {
-  private readonly session: SessionManager<UserServerSession>
+  private readonly serverSession: SessionManager<UserServerSession>
+  private readonly storage = useStorage(OAUTH_CACHE_STORAGE_BASE)
 
   constructor(session: SessionManager<UserServerSession>) {
-    this.session = session
+    this.serverSession = session
   }
 
-  async get(): Promise<NodeSavedState | undefined> {
-    const sessionData = this.session.data
-    if (!sessionData) return undefined
-    return sessionData.oauthState
+  private createStorageKey(did: string, sessionId: string) {
+    return `state:${did}:${sessionId}`
   }
 
-  async set(_key: string, val: NodeSavedState) {
-    // We are ignoring the key since the mapping is already done in the session
-    await this.session.update({
-      oauthState: val,
+  async get(key: string): Promise<NodeSavedState | undefined> {
+    const serverSessionData = this.serverSession.data
+    if (!serverSessionData) return undefined
+    if (!serverSessionData.oauthStateId) return undefined
+    const state = await this.storage.getItem<NodeSavedState>(
+      this.createStorageKey(key, serverSessionData.oauthStateId),
+    )
+    return state ?? undefined
+  }
+
+  async set(key: string, val: NodeSavedState) {
+    let stateId = crypto.randomUUID()
+    await this.serverSession.update({
+      oauthStateId: stateId,
     })
+    await this.storage.setItem<NodeSavedState>(this.createStorageKey(key, stateId), val)
   }
 
-  async del() {
-    await this.session.update({
-      oauthState: undefined,
+  async del(key: string) {
+    const serverSessionData = this.serverSession.data
+    if (!serverSessionData) return undefined
+    if (!serverSessionData.oauthStateId) return undefined
+    await this.storage.removeItem(this.createStorageKey(key, serverSessionData.oauthStateId))
+    await this.serverSession.update({
+      oauthStateId: undefined,
     })
   }
 }
diff --git a/server/utils/atproto/oauth.ts b/server/utils/atproto/oauth.ts
index e82ce85e4..375e4641c 100644
--- a/server/utils/atproto/oauth.ts
+++ b/server/utils/atproto/oauth.ts
@@ -1,13 +1,20 @@
-import type { OAuthClientMetadataInput, OAuthSession } from '@atproto/oauth-client-node'
+import type {
+  OAuthClientMetadata,
+  OAuthRedirectUri,
+  OAuthSession,
+  WebUri,
+} from '@atproto/oauth-client-node'
+import { JoseKey, Keyset, oauthRedirectUriSchema, webUriSchema } from '@atproto/oauth-client-node'
 import type { EventHandlerRequest, H3Event, SessionManager } from 'h3'
 import { NodeOAuthClient, AtprotoDohHandleResolver } from '@atproto/oauth-client-node'
-import { parse } from 'valibot'
 import { getOAuthLock } from '#server/utils/atproto/lock'
 import { useOAuthStorage } from '#server/utils/atproto/storage'
 import { LIKES_SCOPE } from '#shared/utils/constants'
-import { OAuthMetadataSchema } from '#shared/schemas/oauth'
+import type { RuntimeConfig } from 'nuxt/schema'
+import type { UserServerSession } from '#shared/types/userSession'
 // @ts-expect-error virtual file from oauth module
 import { clientUri } from '#oauth/config'
+
 // TODO: If you add writing a new record you will need to add a scope for it
 export const scope = `atproto ${LIKES_SCOPE}`
 
@@ -18,29 +25,42 @@ export const handleResolver = new AtprotoDohHandleResolver({
   dohEndpoint: 'https://cloudflare-dns.com/dns-query',
 })
 
-export function getOauthClientMetadata() {
+/**
+ * Generates the OAuth client metadata. pkAlg is used to signify that the OAuth client is confidential
+ */
+export function getOauthClientMetadata(pkAlg: string | undefined = undefined): OAuthClientMetadata {
   const dev = import.meta.dev
 
   const client_uri = clientUri
-  const redirect_uri = `${client_uri}/api/auth/atproto`
+  const redirect_uri: OAuthRedirectUri = oauthRedirectUriSchema.parse(
+    `${client_uri}/api/auth/atproto`,
+  )
+  const jwks_uri: WebUri | undefined = pkAlg
+    ? webUriSchema.parse(`${client_uri}/.well-known/jwks.json`)
+    : undefined
 
   const client_id = dev
     ? `http://localhost?redirect_uri=${encodeURIComponent(redirect_uri)}&scope=${encodeURIComponent(scope)}`
     : `${client_uri}/oauth-client-metadata.json`
 
   // If anything changes here, please make sure to also update /shared/schemas/oauth.ts to match
-  return parse(OAuthMetadataSchema, {
+  return {
     client_name: 'npmx.dev',
     client_id,
     client_uri,
     scope,
-    redirect_uris: [redirect_uri] as [string, ...string[]],
+    redirect_uris: [redirect_uri],
     grant_types: ['authorization_code', 'refresh_token'],
     application_type: 'web',
-    token_endpoint_auth_method: 'none',
     dpop_bound_access_tokens: true,
     response_types: ['code'],
-  }) as OAuthClientMetadataInput
+    subject_type: 'public',
+    authorization_signed_response_alg: 'RS256',
+    // confidential client values
+    token_endpoint_auth_method: pkAlg ? 'private_key_jwt' : 'none',
+    jwks_uri,
+    token_endpoint_auth_signing_alg: pkAlg,
+  }
 }
 
 type EventHandlerWithOAuthSession<T extends EventHandlerRequest, D> = (
@@ -49,22 +69,50 @@ type EventHandlerWithOAuthSession<T extends EventHandlerRequest, D> = (
   serverSession: SessionManager,
 ) => Promise<D>
 
-async function getOAuthSession(
-  event: H3Event,
-): Promise<{ oauthSession: OAuthSession | undefined; serverSession: SessionManager }> {
+export async function getNodeOAuthClient(
+  serverSession: SessionManager,
+  config: RuntimeConfig,
+): Promise<NodeOAuthClient> {
+  const { stateStore, sessionStore } = useOAuthStorage(serverSession)
+
+  // These are optional and not expected or can be used easily in local development, only in production
+  const keyset = await loadJWKs(config)
+  // @ts-expect-error Taken from statusphere-example-app. Throws a ts error
+  const pk = keyset?.findPrivateKey({ use: 'sig' })
+  const clientMetadata = getOauthClientMetadata(pk?.alg)
+
+  return new NodeOAuthClient({
+    stateStore,
+    sessionStore,
+    clientMetadata,
+    requestLock: getOAuthLock(),
+    handleResolver,
+    keyset,
+  })
+}
+
+export async function loadJWKs(config: RuntimeConfig): Promise<Keyset | undefined> {
+  // If we ever need to add multiple JWKs to rotate keys we will need to add a new one
+  // under a new variable and update here
+  const jwkOne = config.oauthJwkOne
+  if (!jwkOne) return undefined
+
+  // For multiple keys if we need to rotate
+  // const keys = await Promise.all([JoseKey.fromImportable(jwkOne)])
+
+  const keys = await JoseKey.fromImportable(jwkOne)
+  return new Keyset([keys])
+}
+
+async function getOAuthSession(event: H3Event): Promise<{
+  oauthSession: OAuthSession | undefined
+  serverSession: SessionManager<UserServerSession>
+}> {
   const serverSession = await useServerSession(event)
+  const config = useRuntimeConfig(event)
 
   try {
-    const clientMetadata = getOauthClientMetadata()
-    const { stateStore, sessionStore } = useOAuthStorage(serverSession)
-
-    const client = new NodeOAuthClient({
-      stateStore,
-      sessionStore,
-      clientMetadata,
-      requestLock: getOAuthLock(),
-      handleResolver,
-    })
+    const client = await getNodeOAuthClient(serverSession, config)
 
     const currentSession = serverSession.data
     // TODO (jg): why can a session be `{}`?
@@ -108,6 +156,7 @@ export function eventHandlerWithOAuthSession<T extends EventHandlerRequest, D>(
 ) {
   return defineEventHandler(async event => {
     const { oauthSession, serverSession } = await getOAuthSession(event)
+
     return await handler(event, oauthSession, serverSession)
   })
 }
diff --git a/server/utils/atproto/storage.ts b/server/utils/atproto/storage.ts
index 9575250cc..23e0004e2 100644
--- a/server/utils/atproto/storage.ts
+++ b/server/utils/atproto/storage.ts
@@ -3,6 +3,8 @@ import { OAuthStateStore } from './oauth-state-store'
 import { OAuthSessionStore } from './oauth-session-store'
 import type { UserServerSession } from '#shared/types/userSession'
 
+export const OAUTH_CACHE_STORAGE_BASE = 'atproto:oauth'
+
 export const useOAuthStorage = (session: SessionManager<UserServerSession>) => {
   return {
     stateStore: new OAuthStateStore(session),
diff --git a/shared/schemas/oauth.ts b/shared/schemas/oauth.ts
deleted file mode 100644
index 1e72ff319..000000000
--- a/shared/schemas/oauth.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-import { object, string, pipe, url, array, minLength, boolean } from 'valibot'
-
-export const OAuthMetadataSchema = object({
-  client_id: pipe(string(), url()),
-  client_name: string(),
-  client_uri: pipe(string(), url()),
-  redirect_uris: pipe(array(string()), minLength(1)),
-  scope: string(),
-  grant_types: array(string()),
-  application_type: string(),
-  token_endpoint_auth_method: string(),
-  dpop_bound_access_tokens: boolean(),
-  response_types: array(string()),
-})
diff --git a/shared/schemas/publicUserSession.ts b/shared/schemas/publicUserSession.ts
index 1c9e15a92..c3921af93 100644
--- a/shared/schemas/publicUserSession.ts
+++ b/shared/schemas/publicUserSession.ts
@@ -1,12 +1,13 @@
-import { object, string, pipe, url, optional } from 'valibot'
+import * as v from 'valibot'
 import type { InferOutput } from 'valibot'
 
-export const PublicUserSessionSchema = object({
+export const PublicUserSessionSchema = v.object({
   // Safe to pass to the frontend
-  did: string(),
-  handle: string(),
-  pds: pipe(string(), url()),
-  avatar: optional(pipe(string(), url())),
+  did: v.string(),
+  handle: v.string(),
+  pds: v.pipe(v.string(), v.url()),
+  avatar: v.optional(v.pipe(v.string(), v.url())),
+  relogin: v.optional(v.boolean()),
 })
 
 export type PublicUserSession = InferOutput<typeof PublicUserSessionSchema>
diff --git a/shared/types/userSession.ts b/shared/types/userSession.ts
index d761c1336..073764f74 100644
--- a/shared/types/userSession.ts
+++ b/shared/types/userSession.ts
@@ -1,4 +1,4 @@
-import type { NodeSavedSession, NodeSavedState } from '@atproto/oauth-client-node'
+import type { NodeSavedSession } from '@atproto/oauth-client-node'
 
 export interface UserServerSession {
   public?:
@@ -7,11 +7,14 @@ export interface UserServerSession {
         handle: string
         pds: string
         avatar?: string
+        relogin?: boolean
       }
     | undefined
-  // Only to be used in the atproto session and state stores
-  // Will need to change to Record<string, T> and add a current logged in user if we ever want to support
-  // multiple did logins per server session
+  // These values are tied to the users browser session and used by atproto OAuth
+  oauthSessionId?: string | undefined
+  oauthStateId?: string | undefined
+
+  // DO NOT USE
+  // Here for historic reasons to redirect users logged in with the previous oauth to login again
   oauthSession?: NodeSavedSession | undefined
-  oauthState?: NodeSavedState | undefined
 }