JWKS Endpoints

These endpoints allow you to retrieve the public keys needed to verify any access token issued by our authorization server (iss=nopwd.io).

Nopwd uses the JSON Web Key (JWK) specification to represent the cryptographic keys used for signing P256 tokens. This specification defines two high-level data structures: JSON Web Key (JWK) and JSON Web Key Set (JWKS). The public key is in the JWKS Format, enabling you to verify the signature of all generated access tokens.

Method	Resource	Purpose
GET	/jwks/:kid	Returns a specific JSON Web Key (JWK)
GET	/jwks	Returns a set of JSON Web Keys (JWKS)

Signing Keys Rotation

Nopwd uses only one signing key at a time but performs key rotation for security reasons. Since your access_token could be signed just before a key rotation, we provide access to the previous key using these endpoints.

GET /jwks/:kid

Returns a JWK identified by its kid.

Parameters

Param	Type	Mandatory	Description
:kid	Path	Yes	The unique identifier for the signing key

How to Retrieve the JWK Kid?

You can find the signing key’s kid used to sign any of our access tokens in the JWT Header (kid parameter).

Response

interface Jwk {
  kid: string; // The unique identifier for the key
  kty: string; // The family of cryptographic algorithms used with the key (we use EC)
  crv: string; // The curve used, which is "P-256"
  x: string; // The x coordinate of the elliptic curve (base64 url safe)
  y: string; // The y coordinate of the elliptic curve (base64 url safe)
}

Response Codes

Code	Description
200	Request was successful.
404	The key doesn’t exist or has been revoked.

Usage

const response = await fetch(`https://api.nopwd.io/v0/jwks/${kid}`);
const jwk = await response.json();

GET /jwks

Returns all valid JSON Web Keys (JWKs).

Response

interface Jwks {
  keys: Jwk[]
}

Response Codes

Code	Description
200	Request was successful.

Usage

const response = await fetch("https://api.nopwd.io/v0/jwks");
const jwks = await response.json();