# /keys

<div style="margin-top: 16px; margin-bottom: 24px; font-family: sans-serif; display: block; clear: both;">
<span class="lifecycle-badge cors" style="cursor: pointer; background: #6E6E6E; border-radius: 6px; margin-right: 8px; padding: 3px; font-size: 16px; vertical-align: super; color: white; font-weight: bold; display: inline-block;">CORS</span>
</div>
Returns a JSON Web Key Set (JWKS) that contains the public keys that you can use to verify the signatures of tokens that you receive from your authorization server.
> **Note:** Looking for how to obtain the `jwks_uri` for your org authorization server? See the [well-known OpenID Connect metadata endpoint](/openapi/okta-oauth/oauth/customas/getwellknownopenidconfigurationcustomas).

Any of the two or three keys listed are used to sign tokens. The order of keys in the result doesn't indicate which keys are used.
You can use these keys to locally validate JWTs returned by Okta. Standard open-source libraries are available for every major language to perform [JWS](https://datatracker.ietf.org/doc/html/rfc7515) signature validation.
> **Note:** The information returned from this endpoint could lag slightly, but eventually updates.

> **Note:** Okta returns [standard HTTP Cache-Control headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control) for applicable JWKS endpoints. Ensure that you respect the cache header directives, as they are updated based on the time of the request.

For more information on key rotation and best practices, see [JSON Web Key Set](/openapi/okta-oauth/guides/overview/#json-web-key-set).

Endpoint: GET /oauth2/v1/keys

## Query parameters:

  - `client_id` (string)
    The `client_id` of a client app. Providing this optional parameter includes any public keys associated with the signing keys of the app.

## Response 200 fields (application/json):

  - `keys` (array)

  - `keys.alg` (string)
    The type of [JSON Web Key Set](https://tools.ietf.org/html/rfc7517#section-5) algorithm that you must use for signing request objects. When you specify a value for the `request_object_signing_alg` property, all request objects from the client are rejected if not signed with the specified algorithm. You must use the algorithm when the request object is passed by value (using the request parameter). If a value for `request_object_signing_alg` isn't specified, the default is any algorithm that's supported by both the client and the server.
    Enum: "ES256", "ES384", "ES512", "HS256", "HS384", "HS512", "RS256", "RS384", "RS512"

  - `keys.kid` (string)
    The unique identifier of the key

  - `keys.kty` (string)
    The type of public key
    Enum: "EC", "RSA"

  - `keys.status` (string)
    The status of the public key
    Enum: "ACTIVE", "INACTIVE"

  - `keys.use` (string)
    The intended use of the public key
    Enum: "enc", "sig"

## Response 429 fields (application/json):

  - `errorCauses` (array)

  - `errorCauses.errorSummary` (string)

  - `errorCode` (string)
    An Okta code for this type of error

  - `errorId` (string)
    A unique identifier for this error. Okta Support can use this to help with troubleshooting.

  - `errorLink` (string)
    An Okta code for this type of error

  - `errorSummary` (string)
    A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error.