---
title: "Verification Public Key"
method: GET
path: "/.well-known/badge-verification-key.json"
tags: ["verify"]
---

# Verification Public Key

`GET /.well-known/badge-verification-key.json`

## Request

- Base URL: `https://api.badgeia.com`
- URL: `https://api.badgeia.com/.well-known/badge-verification-key.json`
- Auth: none declared

Publish the Ed25519 public key for offline third-party verification.

Returns the raw public key as base64url + the key_id + the algorithm
so a verifier can reconstruct an Ed25519PublicKey and check any
certificate's signature without trusting Badge's server (§9 Q2).

When verification is disabled or the signing key is unavailable in a
non-dev env, returns an empty `keys` list (the document still exists —
well-known endpoints should resolve, not 404) so a verifier sees
"no published key" rather than a server error.

The document is static for the life of a key — served with a 1h
Cache-Control so CDNs/clients don't re-fetch on every verification
(security-auditor LOW follow-up). The per-request public-key
derivation is ~µs (Ed25519), so we keep it un-memoized to stay
correct across a key rotation rather than caching in-process.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/badgeia/apis/badge.md) · [All operations](https://skmtc.dev/badgeia/apis/badge/llms.txt) · [OpenAPI document](https://skmtc.dev/badgeia/apis/badge/revisions/7e7f7fee8b77?raw)