---
title: Get the JSON Web Key Set used to verify tokens
slug: api-documentation/get-the-json-web-key-set-used-to-verify-tokens
docTags: 
createdAt: 2026-09-01T12:15:41.388Z
---

{
  "id": "4jxkG29N4zfxHWgRlvDxm",
  "type": "api-oas-v2",
  "data": {
    "method": "GET",
    "url": "https://api.upstartcommerce.com/.well-known/jwks.json",
    "servers": [
      {
        "url": "https://api.upstartcommerce.com/.well-known/jwks.json",
        "description": "Production"
      }
    ],
    "name": "Get the JSON Web Key Set used to verify tokens",
    "description": "<p>Public keys for verifying access-token signatures. Requires no credentials, sends CORS headers, and is safe to cache — responses carry <code>Cache-Control: max-age=86400</code>. Fetch it once, cache it, and refetch on an unrecognised <code>kid</code> rather than per request.</p>",
    "contentType": "application/json",
    "request": {
      "pathParameters": [],
      "headerParameters": [
        {
          "name": "accept",
          "type": "string",
          "kind": "optional",
          "description": "Generated from available response content types",
          "enum": [
            "application/json"
          ],
          "default": "application/json"
        }
      ],
      "queryParameters": [],
      "bodyDataParameters": [],
      "formDataParameters": [],
      "oAuthParameters": [],
      "cookieParameters": []
    },
    "responses": [
      {
        "statusCode": "200",
        "description": "The key set currently valid for verification.",
        "jsonExample": "",
        "isExpanded": true,
        "schema": [
          {
            "kind": "optional",
            "type": "object",
            "description": "<p>A JSON Web Key Set — the public keys currently valid for verifying access tokens.</p>",
            "customType": "JwksResponse",
            "schema": [
              {
                "name": "keys",
                "kind": "required",
                "type": "array",
                "description": "<p>The active verification keys. Select by <code>kid</code>; expect more than one during a key rotation.</p>",
                "modelRef": "#/components/schemas/JwkKey",
                "customType": "JwkKey[]",
                "schema": [
                  {
                    "name": "kty",
                    "kind": "required",
                    "type": "string",
                    "description": "<p>Key type. Always <code>RSA</code> for this service.</p>",
                    "example": "RSA"
                  },
                  {
                    "name": "kid",
                    "kind": "required",
                    "type": "string",
                    "description": "<p>Key id. Match this against the <code>kid</code> in the token header to pick the right key.</p>",
                    "example": "auth-svc-2026-01"
                  },
                  {
                    "name": "use",
                    "kind": "required",
                    "type": "string",
                    "description": "<p>Intended use. <code>sig</code> — signature verification.</p>",
                    "example": "sig"
                  },
                  {
                    "name": "alg",
                    "kind": "required",
                    "type": "string",
                    "description": "Signing algorithm.",
                    "example": "RS256"
                  },
                  {
                    "name": "n",
                    "kind": "required",
                    "type": "string",
                    "description": "<p>RSA modulus, base64url encoded.</p>"
                  },
                  {
                    "name": "e",
                    "kind": "required",
                    "type": "string",
                    "description": "<p>RSA public exponent, base64url encoded.</p>",
                    "example": "AQAB"
                  }
                ]
              }
            ],
            "modelRef": "#/components/schemas/JwksResponse",
            "isExpanded": true
          }
        ]
      },
      {
        "statusCode": "500",
        "description": "<p>No signing key is available. Only occurs if the service is configured with a symmetric algorithm, which cannot expose a public key.</p>",
        "jsonExample": "",
        "isExpanded": true,
        "schema": [
          {
            "kind": "optional",
            "type": "object",
            "description": "Standard error response format",
            "customType": "ErrorResponse",
            "schema": [
              {
                "name": "error",
                "kind": "required",
                "type": "string",
                "description": "<p>Error type identifier:</p>\n<ul>\n<li><code>invalid_request</code>: Malformed request or missing required fields</li>\n<li><code>unauthorized</code>: Invalid credentials or token</li>\n<li><code>account_not_verified</code>: Account exists but email/phone not verified</li>\n<li><code>session_expired</code>: Maximum session lifetime exceeded, full re-login required</li>\n<li><code>unauthorized_tenant</code>: User not authorized for requested tenant</li>\n<li><code>tenant_required</code>: Multi-tenant user must specify tenant</li>\n<li><code>unauthorized_site</code>: User not authorized for requested site</li>\n<li><code>site_required</code>: Site context required for this operation</li>\n<li><code>no_authorized_sites</code>: User has no authorized sites</li>\n<li><code>forbidden</code>: Access denied (e.g., no authorized tenants)</li>\n<li><code>rate_limited</code>: Too many requests, try again later</li>\n<li><code>account_locked</code>: Account temporarily locked due to failed attempts</li>\n<li><code>internal_error</code>: Server-side error</li>\n</ul>",
                "example": "unauthorized"
              },
              {
                "name": "message",
                "kind": "required",
                "type": "string",
                "description": "<p>Human-readable error description</p>",
                "example": "Invalid username or password"
              },
              {
                "name": "code",
                "kind": "required",
                "type": "string<BAD_REQUEST | UNAUTHORIZED | UNAUTHORIZED_TENANT | TENANT_REQUIRED | FORBIDDEN | RATE_LIMITED | ACCOUNT_LOCKED | INTERNAL_SERVER_ERROR>",
                "description": "HTTP status code name",
                "example": "UNAUTHORIZED",
                "enum": [
                  "BAD_REQUEST",
                  "UNAUTHORIZED",
                  "UNAUTHORIZED_TENANT",
                  "TENANT_REQUIRED",
                  "FORBIDDEN",
                  "RATE_LIMITED",
                  "ACCOUNT_LOCKED",
                  "INTERNAL_SERVER_ERROR"
                ]
              }
            ],
            "modelRef": "#/components/schemas/ErrorResponse",
            "isExpanded": true
          }
        ]
      }
    ],
    "hasXCodeSamples": false,
    "examples": {
      "languages": [
        {
          "id": "yM07bgzhFtgLe-pm9G5qM",
          "language": "curl",
          "label": "cURL",
          "code": "curl --request GET \\\n     --url https://api.upstartcommerce.com/.well-known/jwks.json \\\n     --header 'accept: application/json'"
        },
        {
          "id": "iMkrZJ2kWPkzLsyNeZMOi",
          "language": "javascript",
          "label": "javascript",
          "code": "var myHeaders = new Headers();\nmyHeaders.append(\"accept\", \"application/json\");\nmyHeaders.append(\"content-type\", \"application/json\");\n\nvar requestOptions = {\n   method: 'GET',\n   headers: myHeaders,\n   redirect: 'follow'\n};\n\nfetch(\"https://api.upstartcommerce.com/.well-known/jwks.json\", requestOptions)\n   .then(response => response.text())\n   .then(result => console.log(result))\n   .catch(error => console.log('error', error));"
        },
        {
          "id": "hH5_q2P4dfqgP3r3xZpGg",
          "language": "ruby",
          "label": "Ruby",
          "code": "require \"uri\"\nrequire \"json\"\nrequire \"net/http\"\n\nurl = URI(\"https://api.upstartcommerce.com/.well-known/jwks.json\")\n\nhttps = Net::HTTP.new(url.host, url.port)\nhttps.use_ssl = true\n\nrequest = Net::HTTP::Get.new(url)\nrequest[\"accept\"] = \"application/json\"\nrequest[\"content-type\"] = \"application/json\"\n\nresponse = https.request(request)\nputs response.read_body\n"
        },
        {
          "id": "iaLAYWgVQae_rO_hdFN31",
          "language": "python",
          "label": "Python",
          "code": "import requests\nimport json\n\nurl = \"https://api.upstartcommerce.com/.well-known/jwks.json\"\n\npayload = {}\nheaders = {\n   'accept': 'application/json',\n   'content-type': 'application/json'\n}\n\nresponse = requests.request(\"GET\", url, headers=headers, data=payload)\n\nprint(response.text)\n"
        }
      ],
      "selectedLanguageId": "yM07bgzhFtgLe-pm9G5qM"
    },
    "results": {
      "languages": [
        {
          "id": "aKezNpvTRosPHqKrEAL73",
          "language": "200",
          "code": "// The key set currently valid for verification.\n{\n  \"keys\": [\n    {\n      \"kty\": \"RSA\",\n      \"kid\": \"auth-svc-2026-01\",\n      \"use\": \"sig\",\n      \"alg\": \"RS256\",\n      \"n\": \"\",\n      \"e\": \"AQAB\"\n    }\n  ]\n}"
        },
        {
          "id": "ElQ8IWGlXhC2iNS3euX1_",
          "language": "500",
          "code": "// No signing key is available. Only occurs if the service is configured with a symmetric algorithm, which cannot expose a public key.\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}"
        }
      ],
      "selectedLanguageId": "aKezNpvTRosPHqKrEAL73"
    }
  },
  "children": [
    {
      "text": ""
    }
  ]
}