---
title: "The public keys that sign receipts"
method: GET
path: "/.well-known/phototology-keys.json"
tags: ["Receipts"]
---

# The public keys that sign receipts

`GET /.well-known/phototology-keys.json`

## Request

- Base URL: `https://api.phototology.com`
- URL: `https://api.phototology.com/.well-known/phototology-keys.json`
- Auth: none required

A JSON Web Key Set with every receipt signing key (EC P-256, ES256), old keys included so old receipts keep verifying. The sandbox key carries `"phototology.sandbox": true`. No API key, cached for one hour, limited to 60 requests per minute per IP.

## Response `200`

The key set.

- object
  - `keys` object[], required
    - `kid` string, required
    - `kty` 'EC', required
    - `crv` 'P-256', required
    - `x` string, required
    - `y` string, required
    - `use` 'sig', required
    - `alg` 'ES256', required
    - `phototology.sandbox` true

---

[API](https://skmtc.dev/phototology/apis/phototology-api.md) · [All operations](https://skmtc.dev/phototology/apis/phototology-api/llms.txt) · [OpenAPI document](https://skmtc.dev/phototology/apis/phototology-api/revisions/3cb0fc707b63?raw)