---
title: "Public JWKS for end-user tokens"
method: GET
path: "/credits/.well-known/end-user-jwks.json"
tags: ["End users"]
---

# Public JWKS for end-user tokens

`GET /credits/.well-known/end-user-jwks.json`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/.well-known/end-user-jwks.json`
- Auth: none required

RS256 public keys for verifying end-user tokens yourself, keyed by the token's kid claim. Public and cacheable for 5 minutes. Revoked signing keys are never published, so a token signed by a retired key fails verification here exactly as it does server-side.

## Response `200`

JWK Set

- object
  - `keys` object[], required
    - `kty` 'RSA', required
    - `n` string, required
    - `e` string, required
    - `alg` 'RS256', required
    - `use` 'sig', required
    - `kid` string, required

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)