---
title: "Get Signing Keys"
method: GET
path: "/servers/signing-keys"
tags: ["Servers"]
---

# Get Signing Keys

`GET /servers/signing-keys`

## Request

- Base URL: `https://api.chutes.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.chutes.ai/servers/signing-keys`
- Auth: none declared

Return the signed key bundle used by booting VMs to fetch and verify cosign/Helm keys.

Each entry in 'keys' is a base64-encoded public key; the corresponding entry in
'signatures' is a base64-encoded RSA signature (PKCS#1 v1.5 over SHA-256) produced
offline by the root signing key in Cloud KMS. Nothing here can sign; this only serves.
Intentionally public — no mTLS required. Independent third parties and auditors can
fetch these public keys to verify TDX quotes without needing to be a VM client.

## Response `200`

Successful Response

- string

## Changes

- **2026-10-16** `23e8895b217d`: 1 breaking
  - the response's body type changed from no type to `string` for status `200`
- **2026-08-26** `8d909638091e`: 1 info
  - endpoint added
- **2026-08-22** `05d9af05d87e`: 1 breaking
  - api path removed without deprecation
- **2026-08-04** `352418d4e3a2`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/chutes/apis/chutes-api/changes/servers/signing-keys/get.md)

---

[API](https://skmtc.dev/chutes/apis/chutes-api.md) - [All operations](https://skmtc.dev/chutes/apis/chutes-api/llms.txt) - [OpenAPI document](https://skmtc.dev/chutes/apis/chutes-api/revisions/8add5b0e22da?raw)