JSON Web Key Set (JWKS)#

On this page

The JWKS endpoint provides the public keys used by DIP for signing ID tokens. Clients use these keys to verify the signature of ID tokens received from the token endpoint.

Endpoint#

GET /jwks

Response#

The endpoint returns a JSON Web Key Set (JWKS) as defined in RFC 7517⁠ (opens in a new tab).

Response Headers#

Header	Value
`Content-Type`	`application/json`
`Cache-Control`	`public, max-age=86400`

Response Body#

{
  "keys": [
    {
      "kty": "EC",
      "use": "sig",
      "kid": "123456789",
      "crv": "P-256",
      "x": "base64url-encoded-x-coordinate",
      "y": "base64url-encoded-y-coordinate",
      "x5c": ["base64-encoded-cert", "..."]
    }
  ]
}

Key Properties#

Property	Description
`kty`	Key type. DIP uses `EC` (Elliptic Curve) for signing keys.
`use`	Key usage. `sig` indicates the key is used for signatures.
`kid`	Key ID. The certificate serial number, used to match the key with the `kid` header in JWTs.
`crv`	Curve name. DIP uses `P-256` for ES256 signatures.
`x`	Base64url-encoded x-coordinate of the EC public key.
`y`	Base64url-encoded y-coordinate of the EC public key.
`x5c`	X.509 certificate chain. Contains the signing certificate and its issuing CA certificates.

Usage#

When validating an ID token signature:

1
Decode the ID token header to get the kid (key ID)
2
Fetch the JWKS from this endpoint
3
Find the key with the matching kid
4
Use the public key to verify the signature

Notes#

DIP uses ES256 (ECDSA with P-256 curve) for signing ID tokens
The signing key is separate from the encryption key (clients provide their own RSA key for encryption)
Always match keys by kid - do not assume key order or count