diff --git a/modules/openid-federation-common/src/commonMain/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwt.kt b/modules/openid-federation-common/src/commonMain/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwt.kt
index c5675a7b..b04da780 100644
--- a/modules/openid-federation-common/src/commonMain/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwt.kt
+++ b/modules/openid-federation-common/src/commonMain/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwt.kt
@@ -1,4 +1,4 @@
 package com.sphereon.oid.fed.common.jwt
 
-expect fun sign(payload: String, opts: MutableMap<String, Any>?): String
-expect fun verify(jwt: String, key: Any, opts: MutableMap<String, Any>? = mutableMapOf()): Boolean
+expect fun sign(payload: String, opts: Map<String, Any>): String
+expect fun verify(jwt: String, key: Any, opts: Map<String, Any>): Boolean
diff --git a/modules/openid-federation-common/src/jsMain/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwt.js.kt b/modules/openid-federation-common/src/jsMain/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwt.js.kt
index 94cc41ab..3878a50a 100644
--- a/modules/openid-federation-common/src/jsMain/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwt.js.kt
+++ b/modules/openid-federation-common/src/jsMain/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwt.js.kt
@@ -28,9 +28,9 @@ external object Uuid {
 @JsExport
 actual fun sign(
     payload: String,
-    opts: MutableMap<String, Any>?
+    opts: Map<String, Any>
 ): String {
-    val privateKey = opts?.get("privateKey") ?: throw IllegalArgumentException("JWK private key is required")
+    val privateKey = opts["privateKey"] ?: throw IllegalArgumentException("JWK private key is required")
     val header = opts["jwtHeader"] as String? ?: "{\"typ\":\"JWT\",\"alg\":\"RS256\",\"kid\":\"${Uuid.v4()}\"}"
     return Jose.SignJWT(JSON.parse<Any>(payload).asDynamic())
         .setProtectedHeader(JSON.parse<Any>(header).asDynamic())
@@ -42,7 +42,7 @@ actual fun sign(
 actual fun verify(
     jwt: String,
     key: Any,
-    opts: MutableMap<String, Any>?
+    opts: Map<String, Any>
 ): Boolean {
     return Jose.jwtVerify(jwt, key, opts)
 }
diff --git a/modules/openid-federation-common/src/jsTest/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwtTest.js.kt b/modules/openid-federation-common/src/jsTest/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwtTest.js.kt
index 73be959d..d418ad2e 100644
--- a/modules/openid-federation-common/src/jsTest/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwtTest.js.kt
+++ b/modules/openid-federation-common/src/jsTest/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwtTest.js.kt
@@ -22,7 +22,7 @@ class JoseJwtTest {
     fun verifyTest() = runTest {
         val keyPair = (generateKeyPair("RS256") as Promise<dynamic>).await()
         val signed = (sign("{ \"iss\": \"test\" }", mutableMapOf("privateKey" to keyPair.privateKey)) as Promise<dynamic>).await()
-        val result = async { verify(signed, keyPair.publicKey) }
+        val result = async { verify(signed, keyPair.publicKey, emptyMap()) }
         assertTrue((result.await() as Promise<Boolean>).await())
     }
 }
diff --git a/modules/openid-federation-common/src/jvmMain/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwt.jvm.kt b/modules/openid-federation-common/src/jvmMain/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwt.jvm.kt
index 398b32aa..445fd525 100644
--- a/modules/openid-federation-common/src/jvmMain/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwt.jvm.kt
+++ b/modules/openid-federation-common/src/jvmMain/kotlin/com/sphereon/oid/fed/common/jwt/JoseJwt.jvm.kt
@@ -14,23 +14,21 @@ import java.util.*
 
 actual fun sign(
     payload: String,
-    opts: MutableMap<String, Any>?
+    opts: Map<String, Any>
 ): String {
-    var rsaJWK = opts?.get("key") as RSAKey?
-    val kid = rsaJWK?.keyID ?: UUID.randomUUID().toString()
+    val rsaJWK = opts["key"] as RSAKey? ?: RSAKeyGenerator(2048)
+        .keyID(UUID.randomUUID().toString())
+        .generate()
+
+    val kid = rsaJWK?.keyID
+
     val header: JWSHeader?
-    if (opts?.get("jwtHeader") != null) {
+    if (opts["jwtHeader"] != null) {
         header = JWSHeader.parse(opts["jwtHeader"] as String?)
     } else {
         header = JWSHeader.Builder(JWSAlgorithm.RS256).keyID(kid).build()
     }
 
-    if (rsaJWK == null) {
-        rsaJWK = RSAKeyGenerator(2048)
-            .keyID(kid)
-            .generate()
-    }
-
     val signer: JWSSigner = RSASSASigner(rsaJWK)
 
     val claimsSet = JWTClaimsSet.parse(payload)
@@ -47,7 +45,7 @@ actual fun sign(
 actual fun verify(
     jwt: String,
     key: Any,
-    opts: MutableMap<String, Any>?
+    opts: Map<String, Any>
 ): Boolean {
     try {
         val rsaKey = key as RSAKey