For AI agents: The complete documentation index is available at /docs/llms.txt. A markdown version of this page is available at /docs/apis/jwt/retrieve-public-keys.md.

Retrieve Public Keys API

Edit on GitHub
View Markdown
On this page

This API is used to retrieve Public Keys generated by FusionAuth. These can be used to cryptographically verify JWTs signed with the corresponding private key.

Request#

No Authentication Required
Retrieve all Public Keys
GET/api/jwt/public-key
OpenAPI Spec
No Authentication Required
Retrieve a single Public Key for a specific Application by Application Id
GET/api/jwt/public-key?applicationId={applicationId}
OpenAPI Spec

Request Parameters#

applicationId UUID optional

The Application Id is used to retrieve a specific Public Key. This will return the Public Key that has been specifically configured for the provided Application to sign the access token.

A public key may not be available for an Application if it is configured to use the global JWT configuration or a HMAC is the configured algorithm for JWT signing.

Request Headers#

X-FusionAuth-TenantId String optional

The unique Id of the tenant used to scope this API request.

The tenant Id is not required on this request even when more than one tenant has been configured because the tenant can be identified based upon the request parameters or it is otherwise not required.

Specify a tenant Id on this request when you want to ensure the request is scoped to a specific tenant. The tenant Id may be provided through this header or by using a tenant locked API key to achieve the same result.

See Making an API request using a Tenant Id for additional information.

Available since 1.8.0
No Authentication Required
Retrieve a single Public Key by Key Identifier
GET/api/jwt/public-key?kid={kid}
OpenAPI Spec

Request Parameters#

kid optional

The Key Id used to retrieve a specific Public Key. This will return the Public Key associated with the Key Id.

Response#

Response Codes
CodeDescription
200The request was successful. The response will contain a JSON body.
401You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See Authentication.
404The object you requested doesn't exist. The response will be empty.
500There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty.
503The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body.

Response Body#

publicKeys Map<String, String>

The public keys keyed by the kid.

Example Response JSON for all Public Keys
{
  "publicKeys": {
    "4ed5eb32-0a97-40eb-a6d7-cca1f9fa3a0c": "-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAjocc7+h63/jSkxnT0eaNY\nx1CAKtTB3oIUd6IfxXLdbhHtt7dwtOVkSMxSXR7232ZxFN52iITL6IJNEmq7vrOPd\ndIAlS5qakwqwRR7zaH73dn3JHfDdGI3CJ4/sHbFZZztXTElU44kglbuQv+2QVEHM5\nwLLf4abUWrndjDokgVWzQukTovnS7YgvKcEsgfQDouH6lMnIw/+fXFEA+NWKK/HcX\nMmd2G98DSWUXC1dbwOj9LsPs2Jp4rksjxkzb4SLbq5Lnx22DxfURg7EQtufhr1CO8\nXuw8fA52h0xnZmbVh3zeASe6lf8hY21nPuB+Ih7gIgrUq45P020/KvdfjgKnau980\nMzuxr2DcNOKXDoNUoPys6mOQIINRE+v5Rxbekf758E+OGJjc/8uok8BmAWrolorJO\nwMKpRAnI2M523Pf4czjtz7k2E4LKGs/9UKWlCGgobQ5gwc4ZkkUgk1wx6vjCzXmFH\nkR6U6NvoXs6RBKEptSHN2uIhNNxiin2I/42JWb6kZhtDU88bC6wUwpKEVOrKlFhT0\ne9kelXHPxAq93i+rDomhMMqrZLARAZ+hA7yblN6RlMRlDoiuusG3C/NsqdNZM919r\njo+uymdkfsn07QSWWoLZzxhuyMcDUqWOn9kqbGUQKI+RVT3JNNuggMP7kpGIEobHL\n6PER9atthGjUCAwEAAQ==\n-----END PUBLIC KEY-----\n",
    "default": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnwDYDEUJT9OweW0WG/6tV\nF7MpOJBAvyiyPXaewDvTS5D+2Nop4Ur0VSBrCpeQGT2zaxhGZsqGDlHsPT9vdjSn5\nk55Vu+YWKkv6kcjZNrYtF9tY18BMWeld8WrhQP/P1vQWLHst71LgpvAK3VBWEMZ6l\n/x/i0vzX8HrOBJwxDVZ5r3WjbXIvM7OJ4qf3bQnjRTf/Hps2+LnDIK3u3xrNqtMgU\noY++lNZi0EuFRaKLaAPnynEF2XHaNazv2hHl243aTSXXJIoal54N8BgtXycLVanDL\nD2TfEEKib/p1750tNKB810LiNbiNbEeNO0XQr500ulOEZzVJY5zCmbCaHmPlwIDAQ\nAB\n-----END PUBLIC KEY-----\n"
  }
}

Response Body#

publicKey String

The public key configured for the specified Application.

Example Response JSON for a single Public Key
{
  "publicKey": "-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAjocc7+h63/jSkxnT0eaNY\nx1CAKtTB3oIUd6IfxXLdbhHtt7dwtOVkSMxSXR7232ZxFN52iITL6IJNEmq7vrOPd\ndIAlS5qakwqwRR7zaH73dn3JHfDdGI3CJ4/sHbFZZztXTElU44kglbuQv+2QVEHM5\nwLLf4abUWrndjDokgVWzQukTovnS7YgvKcEsgfQDouH6lMnIw/+fXFEA+NWKK/HcX\nMmd2G98DSWUXC1dbwOj9LsPs2Jp4rksjxkzb4SLbq5Lnx22DxfURg7EQtufhr1CO8\nXuw8fA52h0xnZmbVh3zeASe6lf8hY21nPuB+Ih7gIgrUq45P020/KvdfjgKnau980\nMzuxr2DcNOKXDoNUoPys6mOQIINRE+v5Rxbekf758E+OGJjc/8uok8BmAWrolorJO\nwMKpRAnI2M523Pf4czjtz7k2E4LKGs/9UKWlCGgobQ5gwc4ZkkUgk1wx6vjCzXmFH\nkR6U6NvoXs6RBKEptSHN2uIhNNxiin2I/42JWb6kZhtDU88bC6wUwpKEVOrKlFhT0\ne9kelXHPxAq93i+rDomhMMqrZLARAZ+hA7yblN6RlMRlDoiuusG3C/NsqdNZM919r\njo+uymdkfsn07QSWWoLZzxhuyMcDUqWOn9kqbGUQKI+RVT3JNNuggMP7kpGIEobHL\n6PER9atthGjUCAwEAAQ==\n-----END PUBLIC KEY-----\n"
}

Related

APIs

JWTs & Refresh Token API

Learn about the APIs that allow you to manage Refresh Tokens, verify Access Tokens and retrieve public keys used for verifying JWT signatures.

fusionauth apirest apihttp api
APIs

JSON Web Key Set (JWKS) API

API documentation for the FusionAuth JSON Web Key Set (JWKS) OAuth2 endpoint.

fusionauth apirest apihttp api
APIs

Issue a JWT API

API documentation for the FusionAuth Issue a JWT API.

fusionauth apirest apihttp api
APIs

Reconcile a JWT Using the External JWT Provider API

API documentation for the FusionAuth Reconcile a JWT Using the External JWT Provider API.

fusionauth apirest apihttp api