Fetch a public signing key for independent, offline verification
Returns the public half of a signing key, so anyone can verify a Parmana signature without a Parmana account: ‘an auditor, a regulator, or an endpoint receiving a release.
Authorizations
Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route not listed as exempt in this document's top-level description. See /api-reference/authentication.
Path Parameters
The keyId named in the signature you want to verify, for example default.
Response
The public key.
The key's actual algorithm, derived from the key material itself (asymmetricKeyType), not a global config value.
sig PEM-encoded SPKI public key (RFC 7468).
Node's native JWK export for this key's algorithm, when available. Ed25519 exports as kty "OKP"; ML-DSA-65 exports as kty "AKP" (the IETF JOSE/COSE key type for ML-DSA, not an identifier this codebase invented). Omitted, not null, when unavailable.