GET/api/oidc/jwksPublic

id_token verification keys (JWKS)

The OIDC jwks_uri: the RS256 verification PUBLIC keys of every active keyset for the reserved oidc-userinfo audience, which relying parties need to verify id_token signatures. Creates the first keyset on demand. Unlike GET /api/jwks/{audience} (which serves trusted resource servers the full keyset and requires a JWKS access assertion) this document is public and contains verification keys only. Cached briefly (Cache-Control: public, max-age=300) so rotated-in keysets propagate quickly; served with Access-Control-Allow-Origin: *.

operationId get_api_oidc_jwksOpenID Connect / OAuth 2.0

Authentication & permissionsPublic

Anyone — no credentials required

Accepted credentials
None required
Notes
Unauthenticated by design: public verification keys only.

Responses

application/json
OidcJsonWebKeySet
PropertyTypeDescription
keys*OidcJsonWebKey[]
kty*string

Key type

kid*string

Key id; matches the kid header of id_tokens signed with it.

alg*string
use*string
nstring

RSA modulus (base64url)

estring

RSA public exponent (base64url)

JSONExample
"keys"
"kty""RSA"
"kid""string"
"alg""RS256"
"use""sig"
"n""string"
"e""AQAB"

Example request

bashcurl
curl -X GET 'https://auth.schemavaults.com/api/oidc/jwks'