System
List every public signing key this deployment can currently produce
Same unauthenticated, third-party-verification purpose as GET /keys/ — this is the enumeration form. Not a standards-pure RFC 7517 JWK Set (not every entry necessarily has a jwk field), but a superset any consumer that only wants .jwk per entry can filter down to.
GET
List every public signing key this deployment can currently produce
Authorizations
Caller API key issued by scripts/generate-api-key.ts. Sent as Authorization: Bearer . Verified against a stored SHA-256 hash in constant time by packages/api/src/auth/StaticKeyAuthenticator.ts. Required on every route except GET /health. See /api-reference/authentication.
Response
200 - application/json
Every key this deployment can currently produce a public key for.