diff --git a/docs_src/identity_assertion/tutorial001.py b/docs_src/identity_assertion/tutorial001.py
index 3012f1ed17..afcd537896 100644
--- a/docs_src/identity_assertion/tutorial001.py
+++ b/docs_src/identity_assertion/tutorial001.py
@@ -9,7 +9,7 @@
 from mcp.client.streamable_http import streamable_http_client
 from mcp.shared.auth import OAuthClientInformationFull, OAuthToken
 
-IDP_SIGNING_KEY = "the-enterprise-idp-signing-key"
+IDP_SIGNING_KEY = "the-enterprise-idp-signing-key-for-this-demo"
 
 
 class InMemoryTokenStorage:
diff --git a/docs_src/identity_assertion/tutorial002.py b/docs_src/identity_assertion/tutorial002.py
index d537069f18..8b0dd599b0 100644
--- a/docs_src/identity_assertion/tutorial002.py
+++ b/docs_src/identity_assertion/tutorial002.py
@@ -21,7 +21,7 @@
 ISSUER = "https://auth.example.com/"
 MCP_SERVER = "http://localhost:8001/mcp"
 IDP_ISSUER = "https://idp.example.com"
-IDP_SIGNING_KEY = "the-enterprise-idp-signing-key"
+IDP_SIGNING_KEY = "the-enterprise-idp-signing-key-for-this-demo"
 
 REGISTERED_CLIENTS = {
     "finance-agent": OAuthClientInformationFull(
diff --git a/examples/stories/identity_assertion/idp.py b/examples/stories/identity_assertion/idp.py
index 5d77c665f1..9ce794249b 100644
--- a/examples/stories/identity_assertion/idp.py
+++ b/examples/stories/identity_assertion/idp.py
@@ -14,7 +14,7 @@
 IDP_ISSUER = "https://idp.example.com"
 # Demo only: a real IdP signs with its private key and the authorization server verifies the
 # signature against the IdP's published JWKS. A shared HMAC secret keeps this story self-contained.
-IDP_SIGNING_KEY = "demo-idp-signing-key"
+IDP_SIGNING_KEY = "the-demo-idp-signing-key-for-this-story"
 
 
 def issue_id_jag(*, subject: str, client_id: str, audience: str, resource: str, scope: str) -> str: