Skip to main content
GET
Fetch a public signing key for independent, offline verification

Authorizations

Authorization
string
header
required

Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route except GET /health. See /api-reference/authentication.

Path Parameters

keyId
string
required

Response

The requested public key.

keyId
string
required
algorithm
string
required

The key's actual algorithm, derived from the key material itself (asymmetricKeyType), not a global config value.

use
enum<string>
required
Available options:
sig
pem
string
required

PEM-encoded SPKI public key (RFC 7468).

jwk
object

Node's native JWK export for this key's algorithm, when available. Ed25519 exports as kty "OKP"; ML-DSA-65 exports as kty "AKP" (the IETF JOSE/COSE key type for ML-DSA — not an identifier this codebase invented). Omitted, not null, when unavailable.