---
title: "The Ed25519 public keys Attestwire signs with"
method: GET
path: "/.well-known/attestwire-signing-keys.json"
tags: ["Records"]
---

# The Ed25519 public keys Attestwire signs with

`GET /.well-known/attestwire-signing-keys.json`

## Request

- Base URL: `https://api.attestwire.com`
- URL: `https://api.attestwire.com/.well-known/attestwire-signing-keys.json`
- Auth: none required

A JWK Set (RFC 7517) of the Ed25519 public keys this deployment signs with. Free, unauthenticated, open to any origin, and cacheable for a day while a key is published (five minutes while none is).

Every Ed25519 signature Attestwire hands out names its key by `key_id`; find the entry whose `kid` matches and verify with any Ed25519 library, OpenSSL 3 (`pem`), or `node:crypto`. `kid` is the key's own RFC 7638 thumbprint, so you can recompute it from `x`. `status` is `active` for the key that signs today and `retired` for keys kept so that what they signed can still be checked. Meeting a `key_id` you have not seen means the key was rotated: fetch the set again.

Take the keys from this address. A key or a URL that travels with the thing you are checking proves nothing about who made it.

A deployment with no signing key configured answers `keys: []` and a `note`, and nothing it issues carries an Ed25519 signature — every response that would have carried one says it is unsigned instead.

## Response `200`

The published keys: the active one first, then any retired ones.

- SigningKeySet: A JWK Set. `keys` is the standard member and the only one a JWKS library reads; `issuer`, `docs` and `note` are for a human opening the URL.
  - `issuer` 'Attestwire', required
  - `docs` string, uri, required
  - `note` string: Present only when no key signs on this deployment today, and says so.
  - `keys` SigningKey[], required
    - `kty` 'OKP', required
    - `crv` 'Ed25519', required
    - `x` string, required: The 32-byte public key, base64url without padding.
    - `kid` string, required: The key id every signature names: the RFC 7638 thumbprint of this key — SHA-256 over `{"crv":"Ed25519","kty":"OKP","x":"…"}`, base64url.
    - `use` 'sig', required
    - `status` 'active' | 'retired', required: `active` — signs what this deployment issues today. `retired` — no longer signs, and stays published so that what it signed can still be checked.
    - `pem` string, required: The same key as a PEM `PUBLIC KEY` block, for `openssl pkeyutl -verify -pubin -inkey`.

## Other responses

- `500`: Unhandled fault while reading the signing keys. Never expected; the body carries no detail on purpose (a fault message can quote the offending value). Retry, and email hello@attestwire.com if it persists.

---

[API](https://skmtc.dev/attestwire/apis/attestwire-api.md) · [All operations](https://skmtc.dev/attestwire/apis/attestwire-api/llms.txt) · [OpenAPI document](https://skmtc.dev/attestwire/apis/attestwire-api/revisions/0036f8e043b2?raw)