Sign in
Issuer Keys

List issuer signing keys

List this tenant's issuer signing keys (active, rotated, and not-yet-retired) and the JWKS endpoint where verifiers can fetch the public keys. Call it to inspect the current key lifecycle before or after a rotation, or to discover the JWKS URI to publish to relying parties. Authenticated with the tenant API key; the active signing key is lazily created on first call so the list is never empty.

get/v1/keys

Response

The tenant's signing keys, newest first, plus the JWKS URI for verifiers.

jwks_uristring uri

Absolute URL of this tenant's JWT VC Issuer metadata / JWKS endpoint, where verifiers fetch the public JWKs (active + rotated, not-expired keys) needed to verify issued credentials.

Example response

{
  "keys": [
    {
      "id": "5f6a1c2d-3e4b-5a6c-7d8e-9f0a1b2c3d4e",
      "kid": "Ab3kQ9z1Xy7...",
      "alg": "ES256",
      "status": "active",
      "is_active": true,
      "valid_until": "2027-06-30T12:00:00+00:00",
      "created_at": "2026-06-30T12:00:00+00:00"
    }
  ],
  "jwks_uri": "https://credentials.didit.me/v1/issuers/acme-air/.well-known/jwt-vc-issuer"
}

Changes