GET/api/jwks/{audience}Authenticated

Load an API server's JWKS

Returns the JSON Web Key Set the auth server signs and encrypts tokens for the given API server (audience) with, creating the keyset on first use. The set includes the private JWE decryption key, so only that API server may fetch it: it presents a single-use JWKS access assertion signed with its JWKS access private key (see POST /api/apis/{api_server_id}/jwks-access-key); resource servers built on @schemavaults/auth-server-sdk do this through RemoteJwtKeyManager. The auth server's own keys and the reserved oidc-userinfo keys are never exported here; the public verification keys are served unauthenticated at GET /api/oidc/jwks.

operationId get_api_jwks_audienceResource servers

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user
Notes
The assertion's iss / sub must equal the audience path parameter, so an API server can only load its own JWKS. Every assertion is accepted once.

Path parameters

NameTypeDescription
audience*string

API server id whose JWKS to load; must equal the assertion's issuer

Responses

application/json
JsonWebKeySetThe keys the auth server uses for one API server audience: the RS256 signing keys and the JWE key-wrapping key.
PropertyTypeDescription
keys*JsonWebKey[]
ktystring

Key type

kidstring

Key id, matched against the token header

algstring

Algorithm the key is meant for

usestring

sig (signature) or enc (encryption)

JSONExample
"keys"
"kty""RSA"
"kid""0b6c4a1e-3f7a-4d0e-9b2a-7f3f2d1c8e5a"
"alg""RS256"
"use""sig"
"n""..."
"e""AQAB"

Example request

bashcurl
curl -X GET 'https://auth.schemavaults.com/api/jwks/<audience>' \
  -H 'Authorization: Bearer <access_token>'