Fetch a public signing key for independent, offline verification
Deliberately unauthenticated, like GET /audit/verify and GET /refusal/verify.
Authorizations
Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route not listed as exempt in this document's top-level description. See /api-reference/authentication.
Path Parameters
Response
The requested public key.
The key's actual algorithm, derived from the key material itself (asymmetricKeyType), not a global config value.
sig PEM-encoded SPKI public key (RFC 7468).
Node's native JWK export for this key's algorithm, when available. Ed25519 exports as kty "OKP"; ML-DSA-65 exports as kty "AKP" (the IETF JOSE/COSE key type for ML-DSA, not an identifier this codebase invented). Omitted, not null, when unavailable.