---
title: "set the key guest JWTs are verified against for this workspace"
method: POST
path: "/w/{workspace}/workspaces/edit_guest_jwt_key"
tags: ["workspace"]
---

# set the key guest JWTs are verified against for this workspace

`POST /w/{workspace}/workspaces/edit_guest_jwt_key`

## Request

- Base URL: `/api` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/w/{workspace}/workspaces/edit_guest_jwt_key`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `token`

A guest JWT (`jwt_guest_`) is minted by the embedding customer's own backend and verified against this key: a PEM public key (RS/ES family, HS* refused) or a JWKS URL, at most one. Both empty clears the workspace key; off cloud, verification then falls back to the instance issuer (`JWT_EXT_JWKS_URL`) if one is set, else no guest JWT is accepted (`guest_access_enabled` is the on/off switch). Workspace-admin gated. The key is validated before it is stored. Setting a key is refused with a 400 where guests are unavailable (the shared cloud); clearing one always works.

## Path parameters

- `workspace` string, required

## Request body

- object
  - `public_key` string: A PEM public key (RS or ES family).
  - `jwks_url` string: A JWKS URL whose keys are fetched and refreshed.

## Response `200`

status

## Changes

- **2026-09-05** `c33295e8edd6`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/windmill/apis/windmill-api/changes/w/:workspace/workspaces/edit_guest_jwt_key/post.md)

---

[API](https://skmtc.dev/windmill/apis/windmill-api.md) · [All operations](https://skmtc.dev/windmill/apis/windmill-api/llms.txt) · [OpenAPI document](https://skmtc.dev/windmill/apis/windmill-api/revisions/ac5a7187b9fb?raw)