---
title: "Get public keys for JWT verification in JWK Set format"
method: GET
path: "/.well-known/jwks.json"
tags: ["system"]
---

# Get public keys for JWT verification in JWK Set format

`GET /.well-known/jwks.json`

Retrieve the JSON Web Key Set (JWKS) containing public keys used to verify JWT signatures. This endpoint is used by clients to validate access tokens.

## Response `200`

The public keys in JWK Set format

- JWKSet — JSON Web Key Set for verifying JWT signatures
  - `keys` JWK[], required — Array of public keys
    - `alg` string, required — Algorithm used with this key
    - `e` string, required — RSA public exponent
    - `kid` string, required — Key ID
    - `kty` string, required — Key type
    - `n` string, required — RSA modulus
    - `use` string, required — Key usage

## Other responses

- `default` — An error occurred while processing the request

## Changes

- **2026-06-24** `0fc5fd589dbf` — 1 warning
  - added the new `otp-too-many-attempts` enum value to the `error` response property for the response status `default`
- **2026-04-20** `b39086c84b43` — 1 warning, 1 info
  - added the new `user-already-exists` enum value to the `error` response property for the response status `default`
  - removed the `email-already-in-use` enum value from the `error` response property for the response status `default`
- **2025-11-11** `484d9f1a422a` — 1 warning
  - added the new `provider-account-already-linked` enum value to the `error` response property for the response status `default`
- **2025-10-09** `2bb5c4e40463` — 1 warning, 3 info
  - added the new `email-already-in-use` enum value to the `error` response property for the response status `default`
  - removed the `otp-too-many-attempts` enum value from the `error` response property for the response status `default`
  - removed the `provider-account-already-linked` enum value from the `error` response property for the response status `default`
  - removed the `user-already-exists` enum value from the `error` response property for the response status `default`

[Change history](https://skmtc.dev/nhost/apis/nhost-authentication-api/changes/.well-known/jwks.json/get.md)

---

[API](https://skmtc.dev/nhost/apis/nhost-authentication-api.md) · [All operations](https://skmtc.dev/nhost/apis/nhost-authentication-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nhost/apis/nhost-authentication-api/revisions/7018a6ccd5c9?raw)