Get the JSON Web Key Set used to verify tokens

1 min

GET

https://api.upstartcommerce.com/.well-known/jwks.json

Public keys for verifying access-token signatures. Requires no credentials, sends CORS headers, and is safe to cache — responses carry Cache-Control: max-age=86400. Fetch it once, cache it, and refetch on an unrecognised kid rather than per request.

Responses

200The key set currently valid for verification.

JwksResponse
Description
A JSON Web Key Set — the public keys currently valid for verifying access tokens.
- keysJwkKey[]required
  Description
  The active verification keys. Select by kid; expect more than one during a key rotation.
  - ktystringrequired
    Example
    RSA
    Description
    Key type. Always RSA for this service.
  - kidstringrequired
    Example
    auth-svc-2026-01
    Description
    Key id. Match this against the kid in the token header to pick the right key.
  - usestringrequired
    Example
    sig
    Description
    Intended use. sig — signature verification.
  - algstringrequired
    Example
    RS256
    Description
    Signing algorithm.
  - nstringrequired
    Description
    RSA modulus, base64url encoded.
  - estringrequired
    Example
    AQAB
    Description
    RSA public exponent, base64url encoded.

500

No signing key is available. Only occurs if the service is configured with a symmetric algorithm, which cannot expose a public key.

ErrorResponse
Description
Standard error response format
- errorstringrequired
  Example
  unauthorized
  Description
  Error type identifier:
  
  invalid_request: Malformed request or missing required fields
  
  unauthorized: Invalid credentials or token
  
  account_not_verified: Account exists but email/phone not verified
  
  session_expired: Maximum session lifetime exceeded, full re-login required
  
  unauthorized_tenant: User not authorized for requested tenant
  
  tenant_required: Multi-tenant user must specify tenant
  
  unauthorized_site: User not authorized for requested site
  
  site_required: Site context required for this operation
  
  no_authorized_sites: User has no authorized sites
  
  forbidden: Access denied (e.g., no authorized tenants)
  
  rate_limited: Too many requests, try again later
  
  account_locked: Account temporarily locked due to failed attempts
  
  internal_error: Server-side error
- messagestringrequired
  Example
  Invalid username or password
  Description
  Human-readable error description
- codestring<BAD_REQUEST | UNAUTHORIZED | UNAUTHORIZED_TENANT | TENANT_REQUIRED | FORBIDDEN | RATE_LIMITED | ACCOUNT_LOCKED | INTERNAL_SERVER_ERROR>required
  Example
  UNAUTHORIZED
  Description
  HTTP status code name
  Allowed
  BAD_REQUESTUNAUTHORIZEDUNAUTHORIZED_TENANTTENANT_REQUIREDFORBIDDENRATE_LIMITEDACCOUNT_LOCKEDINTERNAL_SERVER_ERROR

curl

curl --request GET \
     --url https://api.upstartcommerce.com/.well-known/jwks.json \
     --header 'accept: application/json'

javascript

var myHeaders = new Headers();
myHeaders.append("accept", "application/json");
myHeaders.append("content-type", "application/json");

var requestOptions = {
   method: 'GET',
   headers: myHeaders,
   redirect: 'follow'
};

fetch("https://api.upstartcommerce.com/.well-known/jwks.json", requestOptions)
   .then(response => response.text())
   .then(result => console.log(result))
   .catch(error => console.log('error', error));

ruby

require "uri"
require "json"
require "net/http"

url = URI("https://api.upstartcommerce.com/.well-known/jwks.json")

https = Net::HTTP.new(url.host, url.port)
https.use_ssl = true

request = Net::HTTP::Get.new(url)
request["accept"] = "application/json"
request["content-type"] = "application/json"

response = https.request(request)
puts response.read_body

python

import requests
import json

url = "https://api.upstartcommerce.com/.well-known/jwks.json"

payload = {}
headers = {
   'accept': 'application/json',
   'content-type': 'application/json'
}

response = requests.request("GET", url, headers=headers, data=payload)

print(response.text)

200

// The key set currently valid for verification.
{
  "keys": [
    {
      "kty": "RSA",
      "kid": "auth-svc-2026-01",
      "use": "sig",
      "alg": "RS256",
      "n": "",
      "e": "AQAB"
    }
  ]
}

500

// No signing key is available. Only occurs if the service is configured with a symmetric algorithm, which cannot expose a public key.
{
  "error": "unauthorized",
  "message": "Invalid username or password",
  "code": "UNAUTHORIZED"
}