Get the signing keys

The org's public keys, as a JSON Web Key Set, for verifying access tokens.

The org’s public signing keys. Pick the key whose kid matches the token header’s kid.

Authorization

None. This route is public.

Response

200, cacheable for an hour (Cache-Control: public, max-age=3600). Each key is an RSA key with use: "sig" and alg: "RS256"; kid is the key’s thumbprint.

{
  "keys": [
    {
      "kty": "RSA",
      "n": "…",
      "e": "AQAB",
      "kid": "…",
      "use": "sig",
      "alg": "RS256"
    }
  ]
}

An unknown host gets an empty set, {"keys": []}, not a 404.

Example

curl https://acme.loginwith.dev/.well-known/jwks.json