---
title: "Get the IDaaS public encryption key"
method: GET
path: "/v1/keys/idaas"
tags: ["Encryption"]
---

# Get the IDaaS public encryption key

`GET /v1/keys/idaas`

## Request

- Base URL: `https://idaas.yourflexpay.com/api`
- URL: `https://idaas.yourflexpay.com/api/v1/keys/idaas`
- Auth: none required
- TypeScript: <https://skmtc.dev/reflexpay/apis/idaas-identity-as-a-service-api/docs/v1/keys/idaas/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns the IDaaS EC P-256 public key in two formats:
- **`jwk`** – JSON Web Key (JWK) format; import directly into any JOSE library.
- **`publicKeyBase64`** – Base64-encoded X.509 (SubjectPublicKeyInfo) DER; use with
  `KeyFactory.getInstance("EC").generatePublic(new X509EncodedKeySpec(decoded))` in Java.

Use this key to **encrypt request payloads** before sending them to IDaaS:
```
1. Serialize your JSON request body.
2. Encrypt with JWE (alg=ECDH-ES+A256KW, enc=A256GCM) using this public key.
3. Set header: Content-Encryption: JWE
4. Send the JWE compact string as the request body.
```

This endpoint is **unauthenticated** – public keys are safe to distribute.
Cache the response; refresh only if you encounter a JWE decryption error (HTTP 400).

## Response `200`

IDaaS public key returned

- ApiResponseMapStringObject
  - `success` boolean
  - `message` string
  - `errorCode` string
  - `data` object
  - `errors` string[]
  - `timestamp` string, date-time

## Changes

- **2026-04-17** `db1f954badfb`: 1 info
  - added the optional property `errorCode` to the response with the `200` status

[Operation history](https://skmtc.dev/reflexpay/apis/idaas-identity-as-a-service-api/changes/v1/keys/idaas/get.md)

---

[API](https://skmtc.dev/reflexpay/apis/idaas-identity-as-a-service-api.md) - [All operations](https://skmtc.dev/reflexpay/apis/idaas-identity-as-a-service-api/llms.txt) - [OpenAPI document](https://skmtc.dev/reflexpay/apis/idaas-identity-as-a-service-api/revisions/db1f954badfb?raw)