---
title: "Public keys for verifying our signatures"
method: GET
path: "/.well-known/jwks.json"
tags: ["JWKS"]
---

# Public keys for verifying our signatures

`GET /.well-known/jwks.json`

## Request

- Base URL: `https://api.pasito.ai`
- URL: `https://api.pasito.ai/.well-known/jwks.json`
- Auth: none required

The public halves of the KMS keys Pasito signs with. Fetch this to verify the `X-Pasito-Signature-Rsa` header on a webhook delivery (match the `X-Pasito-Key-Id` header to a `kid`, then verify with PS256 / PSS padding) — see the Developer portal's Webhook tab. The same keys also let you verify our access tokens independently, which most integrations do not need. No authentication required; cacheable for 10 minutes.

## Response `200`

JSON Web Key Set holding the public halves of our signing keys.

- Jwks: JSON Web Key Set holding the public halves of our signing keys.
  - `keys` Jwk[], required
    - `kty` string, required
    - `n` string, required: RSA modulus, base64url.
    - `e` string, required: RSA public exponent, base64url.
    - `kid` string, required: RFC 7638 thumbprint. Match it to a token header `kid`, or to the `X-Pasito-Key-Id` header on a webhook delivery.
    - `use` 'sig', required
    - `alg` 'RS256', required: The algorithm for access tokens. Webhook signatures use the same key with PS256 (RSASSA-PSS, salt length 32), so set PSS padding explicitly when verifying one rather than following this hint.

---

[API](https://skmtc.dev/pasito/apis/pasito-external-api.md) - [All operations](https://skmtc.dev/pasito/apis/pasito-external-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pasito/apis/pasito-external-api/revisions/d206e98c9d61?raw)