diff --git a/app-config.yaml b/app-config.yaml
index c24ac1701b..60e2a2b9e0 100644
--- a/app-config.yaml
+++ b/app-config.yaml
@@ -292,6 +292,15 @@ scaffolder:
     visibility: public # or or 'private'
 
 auth:
+  ### Add auth.keyStore.provider to more granularly control how to store JWK data when running
+  # the auth-backend.
+  #
+  # keyStore:
+  #  provider: firestore
+  #  firestore:
+  #    projectId: my-project
+  #    path: my-sessions
+
   environment: development
   ### Providing an auth.session.secret will enable session support in the auth-backend
   # session:
diff --git a/plugins/auth-backend/config.d.ts b/plugins/auth-backend/config.d.ts
index 61bbe15d05..b15b0da628 100644
--- a/plugins/auth-backend/config.d.ts
+++ b/plugins/auth-backend/config.d.ts
@@ -31,6 +31,24 @@ export interface Config {
       secret?: string;
     };
 
+    /** To control how to store JWK data in auth-backend */
+    keyStore?: {
+      provider?: 'postgres' | 'memory' | 'firestore';
+      firestore?: {
+        /** The Google Cloud Project ID */
+        projectId?: string;
+        /**
+         * Local file containing the Service Account credentials.
+         * You can omit this value to automatically read from
+         * GOOGLE_APPLICATION_CREDENTIALS env which is useful for local
+         * development.
+         */
+        keyFilename?: string;
+        /** The path to use for the collection. Defaults to 'sessions' */
+        path?: string;
+      };
+    };
+
     /**
      * The available auth-provider options and attributes
      */