---
title: "Signing keys (JWKS)"
method: GET
path: "/.well-known/jwks.json"
---

# Signing keys (JWKS)

`GET /.well-known/jwks.json`

## Request

- Base URL: `https://api.agentcdn.com`
- URL: `https://api.agentcdn.com/.well-known/jwks.json`
- Auth: none declared

The public keys that verify a UsageReceipt `jws` (the manifest's `jwks_url`). Cached for five minutes; a new key is published before it signs.

## Response `200`

ES256 public keys as a JWKS.

- Jwks: A JSON Web Key Set (RFC 7517) of ES256 public keys. A receipt's `jws` header `kid` names the key that signed it.
  - `keys` object[], required
    - `kty` 'EC', required
    - `crv` 'P-256', required
    - `x` string, required
    - `y` string, required
    - `kid` string, required
    - `alg` 'ES256', required
    - `use` 'sig', required

## Other responses

- `404`: A retired branded host answers 404. Error codes: not_found.
- `503`: The key ring is not configured. Error codes: jwks_unavailable.

---

[API](https://skmtc.dev/agentcdn/apis/agentcdn-public-arv-api.md) · [All operations](https://skmtc.dev/agentcdn/apis/agentcdn-public-arv-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agentcdn/apis/agentcdn-public-arv-api/revisions/f70f6777f2e5?raw)