---
title: "RFC 7517 JWKSet (discovery-only)"
method: GET
path: "/.well-known/jwks.json"
---

# RFC 7517 JWKSet (discovery-only)

`GET /.well-known/jwks.json`

## Request

- Base URL: `https://headlessoracle.com`
- URL: `https://headlessoracle.com/.well-known/jwks.json`
- Auth: none declared

JSON Web Key Set (RFC 7517) form of the active Ed25519 signing key for JOSE-aware verifiers. Single-key set; each key carries an RFC 7638 thumbprint as `kid`. Discovery-only in this release — receipts do not yet carry `kid`, so deployed SDKs continue to verify against /.well-known/oracle-keys.json (hex `public_key`). kid-aware receipt verification is planned for a future major release. Content-Type: application/jwk-set+json. Cache-Control: public, max-age=300.

## Response `200`

JWKSet with the active signing key

## Other responses

- `500`: Public key not configured — CONFIGURATION_ERROR

---

[API](https://skmtc.dev/headlessoracle/apis/headless-oracle.md) · [All operations](https://skmtc.dev/headlessoracle/apis/headless-oracle/llms.txt) · [OpenAPI document](https://skmtc.dev/headlessoracle/apis/headless-oracle/revisions/4e82fe332f29?raw)