# /keys

CORS



Returns a JSON Web Key Set (JWKS) that contains the public keys that you can use to verify the signatures of tokens that you receive from your authorization server.

> Note: Looking for how to obtain the jwks_uri for your org authorization server? See the well-known OpenID Connect metadata endpoint.

Any of the two or three keys listed are used to sign tokens. The order of keys in the result doesn't indicate which keys are used.

You can use these keys to locally validate JWTs returned by Okta. Standard open-source libraries are available for every major language to perform JWS signature validation.

> Note: The information returned from this endpoint could lag slightly, but eventually updates.

> Note: Okta returns standard HTTP Cache-Control headers for applicable JWKS endpoints. Ensure that you respect the cache header directives, as they are updated based on the time of the request.

For more information on key rotation and best practices, see JSON Web Key Set.

Endpoint: GET /oauth2/v1/keys

## Query parameters:

  - `client_id` (string)
    The client_id of a client app. Providing this optional parameter includes any public keys associated with the signing keys of the app.

## Response 200 fields (application/json):

  - `keys` (array) — one of (discriminator: kty):
    - sig:
      - `x` (string)
        The public x coordinate for the elliptic curve point
      - `y` (string)
        The public y coordinate for the elliptic curve point
    - enc:
      - `e` (string)
        The key exponent of an RSA key
      - `n` (string)
        The modulus of the RSA key

  - `keys.alg` (string)
    The type of [JSON Web Key Set](https://tools.ietf.org/html/rfc7517#section-5) algorithm that you must use for signing request objects. When you specify a value for the request_object_signing_alg property, all request objects from the client are rejected if not signed with the specified algorithm. You must use the algorithm when the request object is passed by value (using the request parameter). If a value for request_object_signing_alg isn't specified, the default is any algorithm that's supported by both the client and the server.
    Enum: "ES256", "ES384", "ES512", "HS256", "HS384", "HS512", "RS256", "RS384", "RS512"

  - `keys.kid` (string)
    The unique identifier of the key

  - `keys.kty` (string)
    The type of public key
    Enum: "EC", "RSA"

  - `keys.status` (string)
    The status of the public key
    Enum: "ACTIVE", "INACTIVE"

  - `keys.use` (string)
    The intended use of the public key
    Enum: "enc", "sig"

## Response 429 fields (application/json):

  - `errorCauses` (array)

  - `errorCauses.errorSummary` (string)

  - `errorCode` (string)
    An Okta code for this type of error

  - `errorId` (string)
    A unique identifier for this error. Okta Support can use this to help with troubleshooting.

  - `errorLink` (string)
    An Okta code for this type of error

  - `errorSummary` (string)
    A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error.