---
title: "Fetch the credential issuer's public keys (JWKS)"
method: GET
path: "/.well-known/jwks.json"
tags: ["Registry"]
---

# Fetch the credential issuer's public keys (JWKS)

`GET /.well-known/jwks.json`

## Request

- Base URL: `https://api.baselayer.com`
- URL: `https://api.baselayer.com/.well-known/jwks.json`
- Auth: none declared
- TypeScript: <https://skmtc.dev/baselayer/apis/baselayer-api-service/docs/.well-known/jwks.json/get.ts> (a function with typed inputs; its response is checked against the schema)

The credential issuer's published public keys as an RFC 7517 JSON Web Key Set — the same rotation set the DID document carries, for verifiers that consume a JWKS directly. Unauthenticated; cacheable for one hour.

## Response `200`

The issuer's published public keys (RFC 7517).

- object: RFC 7517 JWKS of the issuer's published public keys.
  - `keys` object[], required
    - `kty` 'OKP'
    - `crv` 'Ed25519'
    - `x` string, required
    - `kid` string, required
    - `alg` 'EdDSA'
    - `use` 'sig'

---

[API](https://skmtc.dev/baselayer/apis/baselayer-api-service.md) - [All operations](https://skmtc.dev/baselayer/apis/baselayer-api-service/llms.txt) - [OpenAPI document](https://skmtc.dev/baselayer/apis/baselayer-api-service/revisions/0cc89938bc26?raw)