Read the provider's signing keys
The public keys that sign ID tokens: one Ed25519 (EdDSA) and one P-256 (ES256), plus the previous pair for 30 days after a rotation.
/oidc/jwks- Access
- Public; API key optional
- Client
- Browser fetch supported
Request examples#
curl -fsS 'https://veil.rip/oidc/jwks'Response#
A JWK Set.
| Field | Type | Meaning |
|---|---|---|
keys | array<object> | Each {kty, crv, x, y?, kid, use: sig, alg}. kid is the RFC 7638 thumbprint; alg is fixed per key. |
Response headers#
| Header | Value | Meaning |
|---|---|---|
Cache-Control | public, max-age=300 | Five minutes. |
What to verify#
Verify a token only with the key its kid names, and only with that key's alg. Refuse none and HS256.
Usage notes#
- Cache-Control: public, max-age=300. Fetch it again when a token names a kid you do not have.
- No API key is read here: an Authorization header on /oidc/ is the app's or the person's own credential.
Errors#
API errors return an error object. Use error.code for program logic; error.message is English text for people and can change. Response and error guide
| HTTP | Code | Meaning and next step |
|---|---|---|
| 404 | not_found | The requested card, key, alias, code or resource was not found. Check the identifier. Temporary codes and previews may already have expired or been used. |
Shared request errors
| HTTP | Code | Meaning and next step |
|---|---|---|
| 429 | rate_limited | An anonymous, signed-request or API-key allowance was exceeded. Wait at least |
| 500 | internal_error | An unexpected server error occurred. Internal details are not returned. Retry reads with bounded backoff. Check write results before sending a new signed operation. |
| 503 | busy | The application has reached a temporary concurrency or database limit. Wait |