Read issuer verification keys

GET

/jwks

const url = 'https://auth.example.invalid/jwks';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://auth.example.invalid/jwks

GET only. Permits Origin headers. No CORS headers are emitted. Retired signing keys remain published for their cache window.

Responses

200

Successful response.

application/json

object

keys

required

Array<object>

object

kty

required

Allowed value: OKP

crv

required

Allowed value: Ed25519

kid

required

string

>= 1 characters

required

string

>= 1 characters

Example

{
  "keys": [
    {
      "kty": "OKP",
      "crv": "Ed25519"
    }
  ]
}

Headers

Cache-Control

string

Allowed value: max-age=300

405

JSON error. Route guards run before proof evaluation; parser failures are 400 and byte overflow is 413. An unexpected failure is 400 unless a route handles it separately.

application/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}

503

Public admission cap (64 in flight), 10 second request deadline, or a route-specific unavailable read/effect. A service authority 503 may follow a binding; retain the request identity.

application/json

object

error

required

string

code

string

outcome

string

Allowed values: not-executed executed unknown

Example

{
  "outcome": "not-executed"
}