---
title: "List issuer signing keys"
method: GET
path: "/v1/keys"
tags: ["Issuer Keys"]
---

# List issuer signing keys

`GET /v1/keys`

List this tenant's issuer signing keys (active, rotated, and not-yet-retired) and the JWKS endpoint where verifiers can fetch the public keys. Call it to inspect the current key lifecycle before or after a rotation, or to discover the JWKS URI to publish to relying parties. Authenticated with the tenant API key; the active signing key is lazily created on first call so the list is never empty.

## Response `200`

The tenant's signing keys, newest first, plus the JWKS URI for verifiers.

- object
  - `keys` object[] — All signing keys for the tenant that are still relevant to verification (status active or rotated), ordered by creation time descending. A rotated key remains listed until it passes its valid_until and is retired.
    - `id` string, uuid — Internal UUID primary key of the signing-key record.
    - `kid` string — JWK key identifier (the RFC 7638 thumbprint of the public key). This is the `kid` placed in the SD-JWT VC header; verifiers resolve the verification key by matching it.
    - `alg` string — JWS signing algorithm used by this key. Always ES256 (ECDSA over P-256 with SHA-256).
    - `status` 'active' | 'rotated' | 'retired' — Key lifecycle state. `active` signs newly issued credentials; `rotated` is superseded but still verifies credentials already issued under it until its valid_until; `retired` is past validity and no longer trusted (retired keys are not returned by this endpoint).
    - `is_active` boolean — True only for the single current signing key (equivalent to status == active). Rotated keys have this set to false.
    - `valid_until` string, date-time, nullable — ISO 8601 timestamp until which a rotated key remains valid for verification (the overlapping-validity window, 365 days from rotation by default). Null for the active key, which has no expiry while active.
    - `created_at` string, date-time — ISO 8601 timestamp when the signing key was created.
  - `jwks_uri` string, uri — Absolute URL of this tenant's JWT VC Issuer metadata / JWKS endpoint, where verifiers fetch the public JWKs (active + rotated, not-expired keys) needed to verify issued credentials.

## Changes

- **2026-06-30** `1ee4908e9af4` — 1 info
  - added the media type `application/json` for the response with the status `200`

[Change history](https://skmtc.dev/didit-protocol/apis/didit-credentials-api/changes/v1/keys/get.md)

---

[API](https://skmtc.dev/didit-protocol/apis/didit-credentials-api.md) · [All operations](https://skmtc.dev/didit-protocol/apis/didit-credentials-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/didit-protocol/didit-credentials-api/revisions/1c34704cfbbb/schema)