diff --git a/plugins/auth-backend/src/identity/DatabaseKeyStore.test.ts b/plugins/auth-backend/src/identity/DatabaseKeyStore.test.ts
index 94dd442b44..ec886856fe 100644
--- a/plugins/auth-backend/src/identity/DatabaseKeyStore.test.ts
+++ b/plugins/auth-backend/src/identity/DatabaseKeyStore.test.ts
@@ -50,7 +50,9 @@ describe('DatabaseKeyStore', () => {
 
     const { items } = await store.listKeys();
     expect(items).toEqual([{ createdAt: expect.anything(), key }]);
-    expect(Math.abs(items[0].createdAt.diffNow('seconds').seconds)).toBeLessThan(10);
+    expect(
+      Math.abs(items[0].createdAt.diffNow('seconds').seconds),
+    ).toBeLessThan(10);
   });
 
   it('should remove stored keys', async () => {
diff --git a/plugins/auth-backend/src/identity/DatabaseKeyStore.ts b/plugins/auth-backend/src/identity/DatabaseKeyStore.ts
index cc4838cf9b..a41abffc7b 100644
--- a/plugins/auth-backend/src/identity/DatabaseKeyStore.ts
+++ b/plugins/auth-backend/src/identity/DatabaseKeyStore.ts
@@ -27,7 +27,7 @@ const migrationsDir = resolvePackagePath(
 const TABLE = 'signing_keys';
 
 type Row = {
-  created_at: Date;
+  created_at: Date; //row.created_at is a string after being returned from the database
   kid: string;
   key: string;
 };
@@ -62,11 +62,18 @@ export class DatabaseKeyStore implements KeyStore {
 
   async listKeys(): Promise<{ items: StoredKey[] }> {
     const rows = await this.database<Row>(TABLE).select();
+
     return {
       items: rows.map(row => ({
-          key: JSON.parse(row.key),
-          createdAt: DateTime.fromFormat(row.created_at, 'yyyy-MM-dd HH:mm:ss', {zone: 'UTC'}),
-        })),
+        key: JSON.parse(row.key),
+        createdAt: DateTime.fromFormat(
+          (row.created_at as unknown) as string,
+          'yyyy-MM-dd HH:mm:ss',
+          {
+            zone: 'UTC',
+          },
+        ),
+      })),
     };
   }
 
diff --git a/plugins/auth-backend/src/identity/TokenFactory.ts b/plugins/auth-backend/src/identity/TokenFactory.ts
index 6874b08789..963251f42b 100644
--- a/plugins/auth-backend/src/identity/TokenFactory.ts
+++ b/plugins/auth-backend/src/identity/TokenFactory.ts
@@ -90,7 +90,9 @@ export class TokenFactory implements TokenIssuer {
 
     for (const key of keys) {
       // Allow for a grace period of another full key duration before we remove the keys from the database
-      const expireAt = key.createdAt.plus({ seconds: 3 * this.keyDurationSeconds });
+      const expireAt = key.createdAt.plus({
+        seconds: 3 * this.keyDurationSeconds,
+      });
       if (expireAt < DateTime.local()) {
         expiredKeys.push(key);
       } else {
@@ -117,14 +119,16 @@ export class TokenFactory implements TokenIssuer {
   private async getKey(): Promise<JSONWebKey> {
     // Make sure that we only generate one key at a time¨
     if (this.privateKeyPromise) {
-      if (this.keyExpiry > DateTime.local()) {
+      if (this.keyExpiry && this.keyExpiry > DateTime.local()) {
         return this.privateKeyPromise;
       }
       this.logger.info(`Signing key has expired, generating new key`);
       delete this.privateKeyPromise;
     }
 
-    this.keyExpiry = DateTime.local().plus({ seconds: this.keyDurationSeconds });
+    this.keyExpiry = DateTime.local().plus({
+      seconds: this.keyDurationSeconds,
+    });
     const promise = (async () => {
       // This generates a new signing key to be used to sign tokens until the next key rotation
       const key = await JWK.generate('EC', 'P-256', {
diff --git a/plugins/auth-backend/src/identity/types.ts b/plugins/auth-backend/src/identity/types.ts
index ac2e662214..4e3eeb872e 100644
--- a/plugins/auth-backend/src/identity/types.ts
+++ b/plugins/auth-backend/src/identity/types.ts
@@ -13,6 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import { DateTime } from 'luxon';
 
 /** Represents any form of serializable JWK */
 export interface AnyJWK extends Record<string, string> {
@@ -52,7 +53,7 @@ export type TokenIssuer = {
  */
 export type StoredKey = {
   key: AnyJWK;
-  createdAt: luxon.DateTime;
+  createdAt: DateTime;
 };
 
 /**