/keys

Request

CORS

Returns a JSON Web Key Set (JWKS) that contains the public keys that you can use to verify the signatures of tokens that you receive from your authorization server.

Note: Looking for how to obtain the jwks_uri for your org authorization server? See the well-known OpenID Connect metadata endpoint.

Any of the two or three keys listed are used to sign tokens. The order of keys in the result doesn't indicate which keys are used.

You can use these keys to locally validate JWTs returned by Okta. Standard open-source libraries are available for every major language to perform JWS signature validation.

Note: The information returned from this endpoint could lag slightly, but eventually updates.

Note: Okta returns standard HTTP Cache-Control headers for applicable JWKS endpoints. Ensure that you respect the cache header directives, as they are updated based on the time of the request.

For more information on key rotation and best practices, see JSON Web Key Set.

Query

client_idstring

The client_id of a client app. Providing this optional parameter includes any public keys associated with the signing keys of the app.

GET

/oauth2/v1/keys

curl -i -X GET \
  'https://okta-subdomain.pixtulate.com/oauth2/v1/keys?client_id=string'

Responses

Success

Headers

Cache-Controlstring

Example:"max-age=3832304, must-revalidate"

Bodyapplication/json

keysArray of objects(JsonWebKey)

Response

{
  "keys": [
    { … },
    { … },
    { … }
  ]
}