How can I use tokens generated from both built-in and custom policies?

I have ADB2C built-in policies working. From this, I authenticate my end users and generate JWT tokens to call APIs through APIM, configured with OpenId Connect. I'm setting up right now custom policies (IEF), thanks to the starter kit but it seems not working properly in parallel.

With built-in policies, everything is OK. But when I try to use tokens generated with IEF, even if all the claims are the same, I always got the error 401 "Authorization has been denied for this request."

After a quick look on the generated token, I saw that the key to sign the token is not the same as for built-in generated tokens.

It is certainly where the error comes from. Indeed, when setting up custom policies, we need to create "policy keys" to sign and encrypt tokens. And by default, it is generated, so different from the built-in ones. But I don't know how to fix this!

Note that I really need to have the same signature and encryption keys for both built-in and custom policies because in APIM I can only use 1 metadata URI for OpenId Connect configuration and 1 configuation URL in section within API operation validation policy.

Note also that I didn't find a way to retrieve the current encryption key (used by built-in policies) for refresh tokens. The problem is the same...

Thanks for your help!

Here is a valid token header including the signature key:

{
  "typ": "JWT",
  "alg": "RS256",
  "kid": "X5eXk4xyojNFum1kl2Ytv8dlNP4-c57dO6QGTVBwaNk"
}

Currently, the kid generated by my policy key is "6jQvK3Cr-pdfMP9ozewO3dnmizxxx_toYfjEnxVpJFs"

When I try to upload the same key as I can find by looking at the metadata URI https://mydomain/tenantId/discovery/v2.0/keys?p=a_ief_policy_name, it is properly uploaded

{
  keys: [
  {
    kid: "X5eXk4xyojNFum1kl2Ytv8dlNP4-c57dO6QGTVBwaNk",
    nbf: 1493763266,
    use: "sig",
    kty: "RSA",
    e: "AQAB",
    n: "tVKUtcx_n9rt[...]VTVSR0hiXudFlfQ2rOhPlpObmku68lXw-7V-P7jwrQRFfQVXw"
  }
  ]
}

But when getting the response of a sign in request I got the error : AADB2C90085: The service has encountered an internal error. Please reauthenticate and try again.