---
title: "Get signing keys"
method: GET
path: "/auth/verify_keys"
tags: ["Webhook Subscriptions"]
---

# Get signing keys

`GET /auth/verify_keys`

## Request

- Base URL: `https://sandbox.upvest.co`
- URL: `https://sandbox.upvest.co/auth/verify_keys`
- Auth: OAuth 2 (client credentials, token URL `https://sandbox.upvest.co/auth/token`, scopes: `webhooks:read`, `webhooks:admin`)

Returns the set of public keys used to verify the signatures on webhook payloads, as a JSON Web Key Set.

Verify the signature of every webhook you receive against these keys before acting on it. Keys rotate, so fetch the current set rather than hard-coding a key.

See the implementing webhooks guide ([TOL](https://docs.upvest.co/products/tol/getting_started/implementing_webhooks) / [BYOL](https://docs.upvest.co/products/byol/getting_started/implementing_webhooks) / [Omnibus](https://docs.upvest.co/products/omnibus/getting_started/implementing_webhooks)) for handler requirements, subscription types, and batching.

## Response `200`

JWKS signing public keys

- object: Webhooks verification keys.
  - `keys` object[], required: The public keys available for verifying webhook signatures.
    - `kid` string, uuid: The identifier of the key, matching the `kid` in the signature header of a webhook payload.
    - `kty` 'EC': The cryptographic algorithm family of the key. * EC — Elliptic curve.
    - `crv` 'P-521': The elliptic curve the key uses. * P-521 — NIST P-521.
    - `x` string: The x coordinate of the elliptic curve point, base64url encoded.
    - `y` string: The y coordinate of the elliptic curve point, base64url encoded.

## Other responses

- `401`: Unauthorized. The caller has not been authenticated.
- `403`: Forbidden. The caller has been authenticated but is not allowed to take the requested action.
- `406`: Not Acceptable. The resource does not have a current representation that would be acceptable to the user agent. "Accept" header defined unsupported value.
- `429`: Too Many Requests. The caller has exceeded their quota for the time period and has been throttled.
- `500`: Internal Server Error. The service encountered an unexpected error.
- `503`: Service Unavailable. The service handling for this request cannot be reached at this time.
- `504`: Gateway Timeout. The service gateway has reached its internal timeout.

---

[API](https://skmtc.dev/upvest/apis/upvest-investment-api.md) · [All operations](https://skmtc.dev/upvest/apis/upvest-investment-api/llms.txt) · [OpenAPI document](https://skmtc.dev/upvest/apis/upvest-investment-api/revisions/ca69534b631d?raw)