# JSON Web Key Set (public signing keys)

`GET /.well-known/jwks.json`

The public keys clients use to verify issued tokens (RFC 7517).

## Authorization

None: this endpoint does not take API credentials.

Responses may be cached for 5 minutes.

## Responses

### 200 OK

The active public verification keys.

Content type: `application/json`

A JSON Web Key Set.

- `keys` (array of objects, required): A public JSON Web Key (RFC 7517). Two key types are published: EC (kty=EC, ES256/P-256) carries crv/x/y per RFC 7518 §6.2, and RSA (kty=RSA, RS256) carries n/e per RFC 7518 §6.3. The two member sets are mutually exclusive, so only kty/use/kid/alg are required — a key serializes exactly the members its own type defines.
  - `kty` (string, required): Example: `"EC"`.
  - `use` (string, required): Example: `"sig"`.
  - `kid` (string, required): Example: `"7Xy1t-abc"`.
  - `alg` (string, required): Example: `"ES256"`.
  - `crv` (string, optional): Example: `"P-256"`.
  - `x` (string, optional): Example: `"f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU"`.
  - `y` (string, optional): Example: `"x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0"`.
  - `n` (string, optional): Example: `"0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbW"`.
  - `e` (string, optional): Example: `"AQAB"`.

## Example request

```bash
curl 'https://auth.example.com/.well-known/jwks.json'
```

## Example response (200)

```json
{
  "keys": [
    {
      "kty": "EC",
      "use": "sig",
      "kid": "7Xy1t...abc",
      "alg": "ES256",
      "crv": "P-256",
      "x": "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
      "y": "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0"
    }
  ]
}
```