The public keys that verify access tokens.

GET

/.well-known/jwks.json

const url = 'https://example.com/api/auth/.well-known/jwks.json';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://example.com/api/auth/.well-known/jwks.json

The current signing key first, then the previous keys still accepted while tokens they signed may be alive. A key’s kid is its RFC 7638 thumbprint. Cacheable for a minute.

Responses

200

The keys, as an RFC 7517 JWK set.

application/json

object

keys

required

Array<object>

object

kty

required

string

Allowed value: EC

crv

required

string

Allowed value: P-256

required

string

required

string

kid

required

string

use

required

string

Allowed value: sig

alg

required

string

Allowed value: ES256

Example

{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "use": "sig",
      "alg": "ES256"
    }
  ]
}