/keys

Request

CORS

Returns a JSON Web Key Set (JWKS) that contains the public keys that you can use to verify the signatures of tokens that you receive from your authorization server.

Note: Looking for how to obtain the jwks_uri for your custom authorization server? See the well-known OpenID Connect metadata endpoint and the well-known OAuth 2.0 metadata endpoint.

Any of the two or three keys listed are used to sign tokens. The order of keys in the result doesn't indicate which keys are used.

You can use these keys to locally validate JWTs returned by Okta. Standard open-source libraries are available for every major language to perform JWS signature validation.

Note: The information returned from this endpoint could lag slightly, but eventually updates.

Path

authorizationServerIdstringrequired

id of the authorization server

GET

/oauth2/{authorizationServerId}/v1/keys

curl -i -X GET \
  'https://okta-subdomain.pixtulate.com/oauth2/{authorizationServerId}/v1/keys'

Responses

Success

Headers

Cache-Controlstring

Example:"max-age=3832304, must-revalidate"

Bodyapplication/json

keysArray of objects(JsonWebKey)

Response

{
  "keys": [
    { … },
    { … },
    { … }
  ]
}