{"revision":"9f11a31dd2951db0","language":"en","entry":{"id":"oidc-jwks","kind":"endpoint","group":"oidc","title":"Read the provider's signing keys","method":"GET","path":"/oidc/jwks","paths":[],"summary":"The public keys that sign ID tokens: one Ed25519 (EdDSA) and one P-256 (ES256), plus the previous pair for 30 days after a rotation.","response":"A JWK Set.","parameters":[],"sample":"/oidc/jwks","access":"public","base":"directory","notes":["Cache-Control: public, max-age=300. Fetch it again when a token names a kid you do not have.","No API key is read here: an Authorization header on /oidc/ is the app's or the person's own credential."],"errors":["404 not_found","429 rate_limited","500 internal_error","503 busy"],"related":["sign-in-with-veil"],"sections":[{"kind":"code","language":"shell","code":"curl -fsS 'https://veil.rip/oidc/jwks'"}],"live":false,"responses":[{"status":200,"contentType":"application/json","description":"A JWK Set.","fields":[{"name":"keys","type":"array<object>","description":"Each {kty, crv, x, y?, kid, use: sig, alg}. kid is the RFC 7638 thumbprint; alg is fixed per key."}]}],"responseObjects":[],"errorFormat":"json","errorDetails":[{"status":404,"code":"not_found","description":"The requested card, key, alias, code or resource was not found.","action":"Check the identifier. Temporary codes and previews may already have expired or been used.","scope":"endpoint"},{"status":429,"code":"rate_limited","description":"An anonymous, signed-request or API-key allowance was exceeded.","action":"Wait at least `Retry-After` seconds. Share a queue and retry budget across your workers.","scope":"common"},{"status":500,"code":"internal_error","description":"An unexpected server error occurred. Internal details are not returned.","action":"Retry reads with bounded backoff. Check write results before sending a new signed operation.","scope":"common"},{"status":503,"code":"busy","description":"The application has reached a temporary concurrency or database limit.","action":"Wait `Retry-After` seconds and retry with bounded backoff.","scope":"common"}],"responseHeaders":[{"name":"Cache-Control","value":"public, max-age=300","description":"Five minutes."}],"verify":"Verify a token only with the key its kid names, and only with that key's alg. Refuse none and HS256.","documentationUrl":"https://veil.rip/docs/oidc-jwks","supportsBrowserFetch":true,"browserMode":"fetch"}}