Error

A valid request URL is required to generate request examples

{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "x": "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
      "y": "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0",
      "kid": "6f1c…",
      "alg": "ES256",
      "use": "sig"
    }
  ]
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

Customer plane

Fetch an environment's public keys

The public half of the verification path: the JWKS document your backend checks session JWTs against.

Addressed by publishable key — the one identifier your backend already holds in config — rather than by an internal id you would have to look up. Public and unauthenticated by design: these are public keys. There is no Origin gate either, because the caller is a server and servers send no Origin.

The response carries Cache-Control: public, max-age=300, stale-while-revalidate=86400. That is deliberate: a verifier must keep verifying through our bad five minutes, so a CDN or an in-process cache should keep answering while a refetch is retried.

Keys are minted on first read, so the document is never empty for a configured environment. When JWT minting is unavailable on the server, the answer is an empty key set rather than an error — the JWKS shape stays valid.

Rate limited to 120 requests per minute per IP; a backend may poll it.

GET

jwks

{publishableKey}

Error

A valid request URL is required to generate request examples

{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "x": "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
      "y": "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0",
      "kid": "6f1c…",
      "alg": "ES256",
      "use": "sig"
    }
  ]
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

Parâmetros de caminho

publishableKey

string

obrigatório

uk_pk_live_… or uk_pk_test_….

Resposta

The environment's servable keys — the active one, plus any rotated out within the grace window.

A JSON Web Key Set. Standard shape, so any JWT library reads it without help.

keys

object[]

Show child attributes

Boot the widget What this environment supports

⌘I

Visão geral

Endpoints

Fetch an environment's public keys

Parâmetros de caminho

Resposta