---
title: "GET /v1/apps/{appId}/jwks"
method: GET
path: "/v1/apps/{appId}/jwks"
tags: ["app"]
---

# GET /v1/apps/{appId}/jwks

`GET /v1/apps/{appId}/jwks`

Returns the Json Web Key Set (public keys) of an app. These keys are used to
verify JWTs sent to app backends.

## Path parameters

- `appId` string, required

## Response `200`

OK

- GetAppJwksResponse
  - `keys` JsonWebKey[], required — The value of the "keys" parameter is an array of JWK values. The order of keys has no meaning.
    - `alg` string — The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. See https://www.rfc-editor.org/rfc/rfc7517#section-4
    - `kid` string, required — The "kid" (key ID) parameter is used to match a specific key. This is used, for instance, to choose among a set of keys within a JWK Set during key rollover. When "kid" values are used within a JWK Set, different keys within the JWK Set SHOULD use distinct "kid" values. The "kid" value is a case-sensitive string. See https://www.rfc-editor.org/rfc/rfc7517#section-4
    - `kty` string, required — The "kty" (key type) parameter identifies the cryptographic algorithm family used with the key, such as "RSA" or "EC". The "kty" value is a case-sensitive string. At the moment, only "RSA" is supported. See https://www.rfc-editor.org/rfc/rfc7517#section-4
    - `n` string, required — The "n" (modulus) parameter contains the modulus value for the RSA public key. It is represented as a Base64urlUInt-encoded value. See https://www.rfc-editor.org/rfc/rfc7518.html#section-6.3
    - `e` string, required — The "e" (exponent) parameter contains the exponent value for the RSA public key. It is represented as a Base64urlUInt-encoded value. See https://www.rfc-editor.org/rfc/rfc7518.html#section-6.3
    - `use` string — The "use" (public key use) parameter identifies the intended use of the public key. The "use" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data. Values are commonly "sig" (signature) or "enc" (encryption). See https://www.rfc-editor.org/rfc/rfc7517#section-4

## Other responses

- `404` — Not Found
- `default` — Error Response

## Changes

- **2026-08-28** `f32aa6ee029d` — 2 warning
  - added the new `design_generation_rejected` enum value to the `code` response property for the response status `404`
  - added the new `design_generation_rejected` enum value to the `code` response property for the response status `default`
- **2026-08-27** `e5ffb199a510` — 4 warning
  - added the new `domain_restricted` enum value to the `code` response property for the response status `404`
  - added the new `domain_restricted` enum value to the `code` response property for the response status `default`
  - added the new `user_already_member` enum value to the `code` response property for the response status `404`
  - added the new `user_already_member` enum value to the `code` response property for the response status `default`

[Change history](https://skmtc.dev/canva/apis/canva-connect-api/changes/v1/apps/:appId/jwks/get.md)

---

[API](https://skmtc.dev/canva/apis/canva-connect-api.md) · [All operations](https://skmtc.dev/canva/apis/canva-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/canva/canva-connect-api/revisions/f32aa6ee029d/schema)