{
"type": "invalid_host_header",
"code": 6317,
"message": "The request's Host header is missing, repeated or malformed; send exactly one Host of the form host[:port].",
"metadata": {}
}
{
"type": "resource_not_found",
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}
{
"type": "validation_failed",
"code": 7112,
"message": "The request is invalid.",
"metadata": {}
}
Public keys and status lists
Fetch the credential issuer's public keys (JWKS)
The published public keys of the credential issuer whose registry host the request names, as an RFC 7517 JSON Web Key Set — the same rotation set that host’s DID document carries, for verifiers that consume a JWKS directly. Unauthenticated; cacheable for one hour.
GET
/
.well-known
/
jwks.json
Fetch the credential issuer's public keys (JWKS)
curl --request GET \ --url https://api.baselayer.com/.well-known/jwks.json
{
"type": "invalid_host_header",
"code": 6317,
"message": "The request's Host header is missing, repeated or malformed; send exactly one Host of the form host[:port].",
"metadata": {}
}
{
"type": "resource_not_found",
"code": 1,
"message": "Could not locate the resource for the given URI.",
"metadata": {}
}
{
"type": "validation_failed",
"code": 7112,
"message": "The request is invalid.",
"metadata": {}
}
Response
The issuer's published public keys (RFC 7517).
RFC 7517 JWKS of the issuer's published public keys.
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"Baselayer","colors":{"primary":"#384ce3","light":"#c6dbf6","dark":"#2232b5"},"logo":{"light":"https://mintcdn.com/baselayer-81245324/D2HqlyNVJCqb8u23/logo/baselayer-wordmark-white.svg?fit=max\u0026auto=format\u0026n=D2HqlyNVJCqb8u23\u0026q=85\u0026s=533e2ee556334e910d3a6d1f2f66ca6a","dark":"https://mintcdn.com/baselayer-81245324/D2HqlyNVJCqb8u23/logo/baselayer-wordmark-white.svg?fit=max\u0026auto=format\u0026n=D2HqlyNVJCqb8u23\u0026q=85\u0026s=533e2ee556334e910d3a6d1f2f66ca6a","href":"https://www.baselayer.com"},"favicon":"https://mintcdn.com/baselayer-81245324/y8jjNyo-CIhfj2Df/favicon.ico?fit=max\u0026auto=format\u0026n=y8jjNyo-CIhfj2Df\u0026q=85\u0026s=5f1029f95d2abd5d4ffd1699330f82ff","navbar":{"links":[{"href":"https://console.baselayer.com","label":"Console"}]},"fonts":{"heading":{"family":"Season Mix","source":"fonts/SeasonMix-Variable.woff2","format":"woff2"},"body":{"family":"Uncut Sans","source":"fonts/UncutSans-Variable.woff2","format":"woff2"}},"styling":{"latex":true},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"baselayer-81245324","hasAudioNarration":false,"actualSubdomain":"baselayer-81245324","customDomains":["docs.baselayer.com"],"gitSource":{"type":"github","owner":"osiris-ratings","repo":"docs-mintlify","deployBranch":"main","contentDirectory":"","isPrivate":true,"mountPath":"","label":""},"chroma":{"collectionId":"c01b8a96-72e8-47f2-acae-28665212b8cb","liveDeploymentHistoryId":"6ae2cd9ed5f357b7dcda2db3","schemaVersion":"v3","latestBuiltDeploymentHistoryId":"6ae2cd9ed5f357b7dcda2db3"},"entitlements":{"AI_CHAT":{"status":"ENABLED"},"WEB_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6ae4b13c39bc6f1b8c505ffe","clientVersion":"0.0.4044","searchFilterCounts":[{"language":"default","tag":"API Reference","count":270},{"language":"default","tag":"Changelog","count":162},{"language":"default","tag":"Businesses","count":133},{"language":"default","tag":"Webhooks","count":81},{"language":"default","tag":"Webhook Events","count":68},{"language":"default","tag":"PRODUCT GUIDES","count":61},{"language":"default","tag":"Verify Businesses \u0026 People","count":60},{"language":"default","tag":"Know Your Agent","count":54},{"language":"default","tag":"Business Verification","count":49},{"language":"default","tag":"Portfolio Monitoring","count":48}]},"assistantConfig":{"enableAskAiButton":false,"enableStarterQuestions":false,"enableContextualStarterQuestions":false,"enableAskAiSearchBar":true},"basePath":"","hasChatPermissions":true,"hasWebMcpPermissions":true,"toggles":[],"googleFontsInlined":false},"customCss":[{"filePath":"style.css","content":"html:not(.dark) #navbar{background:#384ce3!important}html:not(.dark) #navbar div,html:not(.dark) #navbar nav{background-color:transparent!important;backdrop-filter:none!important}html:not(.dark) #navbar *{border-color:rgba(255,255,255,.18)!important}html:not(.dark) #navbar a,html:not(.dark) #navbar button,html:not(.dark) #navbar div,html:not(.dark) #navbar p,html:not(.dark) #navbar span,html:not(.dark) #navbar svg{color:#fff!important}html:not(.dark) #navbar button{background:rgba(255,255,255,.12)!important;border-color:rgba(255,255,255,.25)!important}"}],"page":{"pagePath":"api-reference/registry/fetch-the-credential-issuers-public-keys-jwks","slug":"/api-reference/registry/fetch-the-credential-issuers-public-keys-jwks","pageMetadata":{"title":"Fetch the credential issuer's public keys (JWKS)","description":"The published public keys of the credential issuer whose registry host the request names, as an RFC 7517 JSON Web Key Set — the same rotation set that host's DID document carries, for verifiers that consume a JWKS directly. Unauthenticated; cacheable for one hour.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /.well-known/jwks.json","href":"/api-reference/registry/fetch-the-credential-issuers-public-keys-jwks","autogeneratedByOpenApi":true},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"The published public keys of the credential issuer whose registry host the request names, as an RFC 7517 JSON Web Key Set — the same rotation set that host’s DID document carries, for verifiers that consume a JWKS directly. Unauthenticated; cacheable for one hour.\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){return _jsx(_Fragment,{})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"Fetch the credential issuer's public keys (JWKS)","description":"The published public keys of the credential issuer whose registry host the request names, as an RFC 7517 JSON Web Key Set — the same rotation set that host's DID document carries, for verifiers that consume a JWKS directly. Unauthenticated; cacheable for one hour.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /.well-known/jwks.json","href":"/api-reference/registry/fetch-the-credential-issuers-public-keys-jwks","autogeneratedByOpenApi":true}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":["/_mintlify/custom/baselayer-81245324/8f3f8776472b6600/kya-nudge.js"],"openApiReferenceData":{"operation":{"tags":["Registry"],"summary":"Fetch the credential issuer's public keys (JWKS)","description":"The published public keys of the credential issuer whose registry host the request names, as an RFC 7517 JSON Web Key Set — the same rotation set that host's DID document carries, for verifiers that consume a JWKS directly. Unauthenticated; cacheable for one hour.","operationId":"well_known_jwks_get","responses":{"200":"7d38baa1-6775-45af-b341-758c77465c8e","400":"eea6a95a-35d0-4ad0-9dc9-b912a2ac3113","404":"48cc85cc-9fe9-4081-baac-5905a130f94e","422":"3ac73bab-2e5a-4b78-885a-914595ab7de9"},"method":"get","type":"path","servers":["788562d2-18e0-4de1-8ca6-c9b3fd720b2d"],"security":[],"path":"/.well-known/jwks.json","baseUrlOptions":["https://api.baselayer.com/"],"title":"Fetch the credential issuer's public keys (JWKS)","codeSamples":[],"requiredOnlyExamples":false,"requestExampleType":"generated","responseExampleType":"generated"},"dependencies":{"parameters":{},"responses":{"7d38baa1-6775-45af-b341-758c77465c8e":{"description":"The issuer's published public keys (RFC 7517).","content":{"application/jwk-set+json":{"schema":{"properties":{"keys":{"items":{"properties":{"x":{"type":"string","title":"X","isRequired":true,"uniqueKey":"keys.items.[INDEX].x","typeLabel":"string"},"kid":{"type":"string","title":"Kid","isRequired":true,"uniqueKey":"keys.items.[INDEX].kid","typeLabel":"string"},"kty":{"type":"string","const":"OKP","title":"Kty","default":"OKP","uniqueKey":"keys.items.[INDEX].kty","typeLabel":"string"},"crv":{"type":"string","const":"Ed25519","title":"Crv","default":"Ed25519","uniqueKey":"keys.items.[INDEX].crv","typeLabel":"string"},"alg":{"type":"string","const":"EdDSA","title":"Alg","default":"EdDSA","uniqueKey":"keys.items.[INDEX].alg","typeLabel":"string"},"use":{"type":"string","const":"sig","title":"Use","default":"sig","uniqueKey":"keys.items.[INDEX].use","typeLabel":"string"}},"additionalProperties":false,"type":"object","required":["x","kid"],"title":"Ed25519PublicJWK","description":"Public half of a KYA issuer signing key, as an RFC 8037 OKP JWK.\n\nThe wire form the did:web document and JWKS render verbatim, and the\nshape stored on ``IssuerKey.public_jwk`` — public material only, never\nthe seed. ``kid`` is the RFC 7638 JWK thumbprint of the key, so it is\nderivable from the key material alone and can never drift from ``x``.","uniqueKey":"keys.items.[INDEX]","typeLabel":"Ed25519PublicJWK · object"},"type":"array","title":"Keys","isRequired":true,"uniqueKey":"keys","typeLabel":"Ed25519PublicJWK · object[]"}},"additionalProperties":false,"type":"object","required":["keys"],"title":"JSONWebKeySet","description":"RFC 7517 JWKS of the issuer's published public keys.","uniqueKey":"","typeLabel":"JSONWebKeySet · object"},"example":{"keys":[{"kty":"OKP","crv":"Ed25519","x":"11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo","kid":"kPrK_qmxVWaYVA9wwBF6Iuo3vVzz7TxHCTwXBygrS4k","alg":"EdDSA","use":"sig"}]},"examples":{"Example":{"title":"Example","value":{"keys":[{"kty":"OKP","crv":"Ed25519","x":"11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo","kid":"kPrK_qmxVWaYVA9wwBF6Iuo3vVzz7TxHCTwXBygrS4k","alg":"EdDSA","use":"sig"}]}}},"exampleType":"examples"}},"exampleType":"examples"},"eea6a95a-35d0-4ad0-9dc9-b912a2ac3113":{"description":"The request's Host is missing, repeated or malformed.","content":{"application/json":{"schema":{"properties":{"type":{"type":"string","title":"Type","description":"Stable snake_case name of the error. Branch on this, never on `message`.","isRequired":true,"uniqueKey":"type","typeLabel":"string"},"code":{"type":"integer","title":"Code","description":"Integer catalog code of the error.","isRequired":true,"uniqueKey":"code","typeLabel":"integer"},"message":{"type":"string","title":"Message","description":"For a human reading a log; not stable and not localized.","isRequired":true,"uniqueKey":"message","typeLabel":"string"},"metadata":{"additionalProperties":true,"type":"object","title":"Metadata","description":"Context documented per `type`.","uniqueKey":"metadata","typeLabel":"Metadata · object"},"request_id":{"oneOf":[{"type":"string","title":"Request Id","description":"The `X-Request-ID` of the failed request.","uniqueKey":"request_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Request Id","description":"The `X-Request-ID` of the failed request.","uniqueKey":"request_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"request_id","typeLabel":"string | null"}},"type":"object","required":["type","code","message"],"title":"InvalidHostHeader","description":"The request's Host header is missing, repeated or malformed; send exactly one Host of the form host[:port].","examples":[{"type":"invalid_host_header","code":6317,"message":"The request's Host header is missing, repeated or malformed; send exactly one Host of the form host[:port].","metadata":{}}],"uniqueKey":"","typeLabel":"InvalidHostHeader · object"},"examples":{"Example":{"title":"Example","value":{"type":"invalid_host_header","code":6317,"message":"The request's Host header is missing, repeated or malformed; send exactly one Host of the form host[:port].","metadata":{}}}},"exampleType":"generated"}},"exampleType":"generated"},"48cc85cc-9fe9-4081-baac-5905a130f94e":{"description":"The request's Host is not one of the issuers' registry hosts.","content":{"application/json":{"schema":{"properties":{"type":{"type":"string","title":"Type","description":"Stable snake_case name of the error. Branch on this, never on `message`.","isRequired":true,"uniqueKey":"type","typeLabel":"string"},"code":{"type":"integer","title":"Code","description":"Integer catalog code of the error.","isRequired":true,"uniqueKey":"code","typeLabel":"integer"},"message":{"type":"string","title":"Message","description":"For a human reading a log; not stable and not localized.","isRequired":true,"uniqueKey":"message","typeLabel":"string"},"metadata":{"additionalProperties":true,"type":"object","title":"Metadata","description":"Context documented per `type`.","uniqueKey":"metadata","typeLabel":"Metadata · object"},"request_id":{"oneOf":[{"type":"string","title":"Request Id","description":"The `X-Request-ID` of the failed request.","uniqueKey":"request_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Request Id","description":"The `X-Request-ID` of the failed request.","uniqueKey":"request_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"request_id","typeLabel":"string | null"}},"type":"object","required":["type","code","message"],"title":"ResourceNotFound","description":"Could not locate the resource for the given URI.","examples":[{"type":"resource_not_found","code":1,"message":"Could not locate the resource for the given URI.","metadata":{}}],"uniqueKey":"","typeLabel":"ResourceNotFound · object"},"examples":{"Example":{"title":"Example","value":{"type":"resource_not_found","code":1,"message":"Could not locate the resource for the given URI.","metadata":{}}}},"exampleType":"generated"}},"exampleType":"generated"},"3ac73bab-2e5a-4b78-885a-914595ab7de9":{"description":"The request is invalid.","content":{"application/json":{"schema":{"properties":{"type":{"type":"string","title":"Type","description":"Stable snake_case name of the error. Branch on this, never on `message`.","isRequired":true,"uniqueKey":"type","typeLabel":"string"},"code":{"type":"integer","title":"Code","description":"Integer catalog code of the error.","isRequired":true,"uniqueKey":"code","typeLabel":"integer"},"message":{"type":"string","title":"Message","description":"For a human reading a log; not stable and not localized.","isRequired":true,"uniqueKey":"message","typeLabel":"string"},"metadata":{"additionalProperties":true,"type":"object","title":"Metadata","description":"Context documented per `type`.","uniqueKey":"metadata","typeLabel":"Metadata · object"},"request_id":{"oneOf":[{"type":"string","title":"Request Id","description":"The `X-Request-ID` of the failed request.","uniqueKey":"request_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Request Id","description":"The `X-Request-ID` of the failed request.","uniqueKey":"request_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"request_id","typeLabel":"string | null"}},"type":"object","required":["type","code","message"],"title":"ValidationFailed","description":"The request is invalid.","examples":[{"type":"validation_failed","code":7112,"message":"The request is invalid.","metadata":{}}],"uniqueKey":"","typeLabel":"ValidationFailed · object"},"examples":{"Example":{"title":"Example","value":{"type":"validation_failed","code":7112,"message":"The request is invalid.","metadata":{}}}},"exampleType":"generated"}},"exampleType":"generated"}},"security":{},"servers":{"788562d2-18e0-4de1-8ca6-c9b3fd720b2d":{"url":"https://api.baselayer.com/"}}},"originalFileLocation":"api-reference/openapi.json"},"subdomain":"baselayer-81245324","siteName":"Baselayer","title":"Fetch the credential issuer's public keys (JWKS) - Baselayer","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-10-29T05:45:39.859Z","originalFileLocation":"api-reference/registry/fetch-the-credential-issuers-public-keys-jwks.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"The published public keys of the credential issuer whose registry host the request names, as an RFC 7517 JSON Web Key Set — the same rotation set that host\u0026#x27;s DID document carries, for verifiers that consume a JWKS directly. Unauthenticated; cacheable for one hour.\">\u003cmeta data-mint-head name=\"application-name\" content=\"Baselayer\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/baselayer-81245324/PX_ZXIXr1oHoY_hi/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/baselayer-81245324/PX_ZXIXr1oHoY_hi/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/baselayer-81245324/PX_ZXIXr1oHoY_hi/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/baselayer-81245324/PX_ZXIXr1oHoY_hi/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/baselayer-81245324/PX_ZXIXr1oHoY_hi/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/baselayer-81245324/PX_ZXIXr1oHoY_hi/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/baselayer-81245324/PX_ZXIXr1oHoY_hi/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/baselayer-81245324/PX_ZXIXr1oHoY_hi/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/baselayer-81245324/PX_ZXIXr1oHoY_hi/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Fetch the credential issuer\u0026#x27;s public keys (JWKS) - Baselayer\">\u003cmeta data-mint-head property=\"og:description\" content=\"The published public keys of the credential issuer whose registry host the request names, as an RFC 7517 JSON Web Key Set — the same rotation set that host\u0026#x27;s DID document carries, for verifiers that consume a JWKS directly. Unauthenticated; cacheable for one hour.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Baselayer\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.baselayer.com/api-reference/registry/fetch-the-credential-issuers-public-keys-jwks\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://baselayer-81245324.mintlify.app/_mintlify/api/og/v2?division=Public+keys+and+status+lists\u0026amp;title=Fetch+the+credential+issuer%27s+public+keys+%28JWKS%29\u0026amp;description=The+published+public+keys+of+the+credential+issuer+whose+registry+host+the+request+names%2C+as+an+RFC+7517+JSON+Web+Key+Set+%E2%80%94+the+same+rotation+set+that+host%27s+DI\u0026amp;theme=da3e09036423c5729d7edf96\u0026amp;signature=f6f939917e3f850fe61722e5fa80e8a5c91eaff961a5ca61a038fd222a9a515e\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Fetch the credential issuer\u0026#x27;s public keys (JWKS) - Baselayer\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"The published public keys of the credential issuer whose registry host the request names, as an RFC 7517 JSON Web Key Set — the same rotation set that host\u0026#x27;s DID document carries, for verifiers that consume a JWKS directly. Unauthenticated; cacheable for one hour.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://baselayer-81245324.mintlify.app/_mintlify/api/og/v2?division=Public+keys+and+status+lists\u0026amp;title=Fetch+the+credential+issuer%27s+public+keys+%28JWKS%29\u0026amp;description=The+published+public+keys+of+the+credential+issuer+whose+registry+host+the+request+names%2C+as+an+RFC+7517+JSON+Web+Key+Set+%E2%80%94+the+same+rotation+set+that+host%27s+DI\u0026amp;theme=da3e09036423c5729d7edf96\u0026amp;signature=f6f939917e3f850fe61722e5fa80e8a5c91eaff961a5ca61a038fd222a9a515e\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/baselayer-81245324/PX_ZXIXr1oHoY_hi/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Baselayer\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#384ce3\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.baselayer.com/api-reference/registry/fetch-the-credential-issuers-public-keys-jwks\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/api-reference/registry/fetch-the-credential-issuers-public-keys-jwks.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://docs.baselayer.com/#organization\",\"name\":\"Baselayer\",\"url\":\"https://docs.baselayer.com\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/baselayer-81245324/D2HqlyNVJCqb8u23/logo/baselayer-wordmark-white.svg?fit=max\u0026auto=format\u0026n=D2HqlyNVJCqb8u23\u0026q=85\u0026s=533e2ee556334e910d3a6d1f2f66ca6a\"}},{\"@type\":\"WebSite\",\"@id\":\"https://docs.baselayer.com#website\",\"name\":\"Baselayer\",\"url\":\"https://docs.baselayer.com\",\"publisher\":{\"@id\":\"https://docs.baselayer.com/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.baselayer.com/api-reference/registry/fetch-the-credential-issuers-public-keys-jwks#webpage\",\"url\":\"https://docs.baselayer.com/api-reference/registry/fetch-the-credential-issuers-public-keys-jwks\",\"name\":\"Fetch the credential issuer's public keys (JWKS)\",\"description\":\"The published public keys of the credential issuer whose registry host the request names, as an RFC 7517 JSON Web Key Set — the same rotation set that host's DID document carries, for verifiers that consume a JWKS directly. Unauthenticated; cacheable for one hour.\",\"dateModified\":\"2026-10-29T05:45:39.859Z\",\"isPartOf\":{\"@id\":\"https://docs.baselayer.com#website\"},\"breadcrumb\":{\"@id\":\"https://docs.baselayer.com/api-reference/registry/fetch-the-credential-issuers-public-keys-jwks#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.baselayer.com/api-reference/registry/fetch-the-credential-issuers-public-keys-jwks#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Public keys and status lists\",\"item\":\"https://docs.baselayer.com/api-reference/registry/resolve-the-credential-issuers-did-document\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Fetch the credential issuer's public keys (JWKS)\",\"item\":\"https://docs.baselayer.com/api-reference/registry/fetch-the-credential-issuers-public-keys-jwks\"}]},{\"@type\":[\"TechArticle\",\"APIReference\"],\"@id\":\"https://docs.baselayer.com/api-reference/registry/fetch-the-credential-issuers-public-keys-jwks#apireference\",\"headline\":\"Fetch the credential issuer's public keys (JWKS)\",\"name\":\"Fetch the credential issuer's public keys (JWKS)\",\"description\":\"The published public keys of the credential issuer whose registry host the request names, as an RFC 7517 JSON Web Key Set — the same rotation set that host's DID document carries, for verifiers that consume a JWKS directly. Unauthenticated; cacheable for one hour.\",\"url\":\"https://docs.baselayer.com/api-reference/registry/fetch-the-credential-issuers-public-keys-jwks\",\"mainEntityOfPage\":{\"@id\":\"https://docs.baselayer.com/api-reference/registry/fetch-the-credential-issuers-public-keys-jwks#webpage\"},\"dateModified\":\"2026-10-29T05:45:39.859Z\",\"publisher\":{\"@id\":\"https://docs.baselayer.com/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.baselayer.com#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Baselayer\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Baselayer","nav":{"global":null,"tabs":[{"tab":"Get Started","icon":"rocket","pages":[{"title":"Get Started","href":"/docs/meet-baselayer"}]},{"tab":"Verify Businesses \u0026 People","icon":"book-open","pages":[{"title":"Verify Businesses \u0026 People","href":"/docs/business-verification-basics"}]},{"tab":"Know Your Agent","icon":"robot","pages":[{"title":"Know Your Agent","href":"/docs/kya-overview"}]},{"tab":"Hosted Enrollment","icon":"id-card","pages":[{"title":"Hosted Enrollment","href":"/hosted-enrollment/overview"}]},{"tab":"MCP","icon":"plug","pages":[{"title":"MCP","href":"/docs/mcp"}]},{"tab":"API Reference","icon":"square-terminal","anchors":[{"anchor":"Businesses","icon":"building","pages":[{"title":"Businesses","href":"/api-reference/search/post-search"}]},{"anchor":"People","icon":"user","pages":[{"title":"People","href":"/api-reference/people/create-person"}]},{"anchor":"Know Your Agent","icon":"robot","groups":[{"group":"Credentials","pages":[{"group":"Mint","pages":[{"title":"Mint a credential for a person or a business operator","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /issuance/credentials","href":"/api-reference/credentials/mint-a-credential-for-a-person-or-a-business-operator"},{"title":"Preview what an L3 mint would disclose","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /issuance/credentials/preview","href":"/api-reference/credentials/preview-what-an-l3-mint-would-disclose"},{"title":"List the presets an L3 mint can disclose by","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /issuance/credentials/presets","href":"/api-reference/credentials/list-the-presets-an-l3-mint-can-disclose-by"},{"title":"Mint a test credential for a person or a business operator","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /issuance/credentials/test","href":"/api-reference/credentials/mint-a-test-credential-for-a-person-or-a-business-operator"},{"title":"Preview what an L3 test mint would disclose","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /issuance/credentials/test/preview","href":"/api-reference/credentials/preview-what-an-l3-test-mint-would-disclose"}]},{"group":"Issued Credentials","pages":[{"title":"Resolve one credential record by its credential_id","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /issuance/credentials/{credential_id}","href":"/api-reference/credentials/resolve-one-credential-record-by-its-credential_id"},{"title":"List your organization's credential records","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /issuance/credentials","href":"/api-reference/credentials/list-your-organizations-credential-records"},{"title":"Revoke one credential","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /issuance/credentials/{credential_id}/revoke","href":"/api-reference/credentials/revoke-one-credential"}]},{"group":"Credential Events","pages":[{"title":"List your organization's credential events","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /issuance/credentials/events","href":"/api-reference/credentials/list-your-organizations-credential-events"},{"title":"Export your organization's credential events","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /issuance/credentials/events/export","href":"/api-reference/credentials/export-your-organizations-credential-events"}]}]},{"group":"Identities","pages":[{"group":"Hosted Sessions","pages":[{"title":"Start a hosted enrollment session","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /onboarding/sessions","href":"/api-reference/onboarding/start-a-hosted-enrollment-session"},{"title":"Get a hosted enrollment session","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /onboarding/sessions/{session_id}","href":"/api-reference/onboarding/get-a-hosted-enrollment-session"},{"title":"Get a hosted enrollment session's results","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /onboarding/sessions/{session_id}/results","href":"/api-reference/onboarding/get-a-hosted-enrollment-sessions-results"}]},{"group":"Direct Verifications","pages":[{"title":"Start a direct verification","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /issuance/identities/verifications","href":"/api-reference/identities/start-a-direct-verification"},{"title":"Get a direct verification","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /issuance/identities/verifications/{verification_id}","href":"/api-reference/identities/get-a-direct-verification"},{"title":"List direct verifications","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /issuance/identities/verifications","href":"/api-reference/identities/list-direct-verifications"}]},{"group":"Verified Identities","pages":[{"title":"List the individuals your organization has verified","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /issuance/identities/individuals","href":"/api-reference/identities/list-the-individuals-your-organization-has-verified"},{"title":"Look up a verified identity by pairwise reference","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /issuance/identities/individuals/{individual_ref}","href":"/api-reference/identities/look-up-a-verified-identity-by-pairwise-reference"},{"title":"Re-verify an identity from its stored verification","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /issuance/identities/individuals/{individual_ref}/reverify","href":"/api-reference/identities/re-verify-an-identity-from-its-stored-verification"},{"title":"List the businesses your organization has verified","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /issuance/identities/businesses","href":"/api-reference/identities/list-the-businesses-your-organization-has-verified"},{"title":"Look up a verified business by pairwise reference","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /issuance/identities/businesses/{business_ref}","href":"/api-reference/identities/look-up-a-verified-business-by-pairwise-reference"}]},{"group":"Operator Links","pages":[{"title":"List your organization's operator links","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /issuance/identities/operator_links","href":"/api-reference/identities/list-your-organizations-operator-links"},{"title":"Get one operator link with its evidence","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /issuance/identities/businesses/{business_ref}/operator_links/{individual_ref}","href":"/api-reference/identities/get-one-operator-link-with-its-evidence"},{"title":"Verify or reject that an individual operates a business","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json post /issuance/identities/businesses/{business_ref}/operator_links/{individual_ref}/decide","href":"/api-reference/identities/verify-or-reject-that-an-individual-operates-a-business"}]}]},{"group":"Public keys and status lists","pages":[{"title":"Resolve the credential issuer's DID document","description":"The W3C DID document for the Baselayer credential issuer whose registry host the request names: production and sandbox each publish their own on their own host. It carries the same keys as the host's JWT VC Issuer Metadata, for did-aware tooling; credentials name an https issuer, so verifiers resolve keys through `/.well-known/jwt-vc-issuer`. Keys publish ahead of activation and remain published through rotation overlap, so verifier caches stay warm. Unauthenticated; cacheable for one hour.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /.well-known/did.json","href":"/api-reference/registry/resolve-the-credential-issuers-did-document"},{"title":"Fetch the credential issuer's public keys (JWKS)","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /.well-known/jwks.json","href":"/api-reference/registry/fetch-the-credential-issuers-public-keys-jwks"},{"title":"Fetch the credential issuer's JWT VC Issuer Metadata","description":"JWT VC Issuer Metadata (draft-ietf-oauth-sd-jwt-vc-19 §4) for the credential issuer whose registry host the request names: `issuer` equals the `iss` of every credential that issuer signs, and `jwks` carries the same rotation set as that host's JWKS. Verifiers resolve a credential's signing key here. Unauthenticated; cacheable for one hour.","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /.well-known/jwt-vc-issuer","href":"/api-reference/registry/fetch-the-credential-issuers-jwt-vc-issuer-metadata"},{"title":"Fetch the credential status list token","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /statuslists/{list_id}","href":"/api-reference/registry/fetch-the-credential-status-list-token"},{"title":"Fetch the individual credential's type metadata","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /vct/kya/individual/v1","href":"/api-reference/registry/fetch-the-individual-credentials-type-metadata"},{"title":"Fetch the business credential's type metadata","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /vct/kya/business/v1","href":"/api-reference/registry/fetch-the-business-credentials-type-metadata"}]},{"group":"Audit Log","pages":[{"title":"Read the calling organization's slice of the audit log","deprecated":null,"version":null,"openapi":"/api-reference/openapi.json get /issuance/audit_log","href":"/api-reference/audit-log/read-the-calling-organizations-slice-of-the-audit-log"}]}]},{"anchor":"Admin","icon":"gear","pages":[{"title":"Admin","href":"/api-reference/organization-management/create-organization-for-federation"}]},{"anchor":"Webhooks","icon":"webhook","pages":[{"title":"Webhooks","href":"/api-reference/webhook-management/create-webhook-endpoint"}]}]},{"tab":"Changelog","icon":"clock-rotate-left","pages":[{"title":"Changelog","href":"/changelog/texas-comptroller-franchise-tax-standing"}]}]},"basePath":"","title":"Fetch the credential issuer's public keys (JWKS) - Baselayer","buildId":"dpl_DeHjVRGfFnhYQwHnfC2pjeXXv8h9","deploymentId":"dpl_DeHjVRGfFnhYQwHnfC2pjeXXv8h9","dynamics":["c2aa737661","2b790eda92","b0f84f53ff","a9bb46feb3"],"chunks":["OpenApiReferenceProvider-CS552b7R.js","utils-DDTCYAF2.js","cloneDeep-izs3Hzxb.js","_Uint8Array-BVIqJ90l.js","isObjectLike-C8vmzPEN.js","isArray-Dcu1dQ5t.js","utils-De8ttokP.js","toString-BX-iyh8G.js","isSymbol-CSH9U2Gm.js","addUniqueKeysToSchema-DrwRDvAh.js","snippetPresets-DtAN0nWx.js","style-to-object-BY3JEAdk.js","v4-DIgz8zy6.js","ApiExamples-D5rWArI6.js","isEqual-BfaiBbcl.js","usePlaygroundInputsStore-O2i12wsz.js","shallow-DV8xABTt.js","getApiPlaygroundDisplay-DBZ0B5Jx.js","CodeSnippet-BVi0tPUX.js","CodeSnippets-CqASbIwY.js","Page-m07pfKpT.js","getPastedJson-DG9vsMS8.js","icon-CXzRSCr8.js","MethodPill-BdKVtEuX.js","DuplicateIcon-CZlmBrJI.js","createIcon-biFEUKPL.js","DynamicMarkdown-B54_zNBF.js","SectionHeading-DwwHK3Pt.js","axios-vUo_bRtp.js","Markdown-DfhCTwyA.js","clsx-xpJZXxdP.js","lib-DuNMoZ05.js","lib-B8HbPgcC.js","html-void-elements-mCSPHezU.js","dist-BTZUMDnx.js","katex-YMM-FMeD.js","marked.esm-CZWythHk.js","AssistantPageLink-DqdKa2R4.js"]}