Skip to main content
GET
Get the Ephemeral JWKS

Credential

None (public)

Processing

Realtime
Returns the JSON Web Key Set of public keys used to sign Ephemeral Keys. Any verifier - including the GoldRush edge - uses it to validate a gr_ek_… token’s signature offline, without a round-trip to the control plane. Keys are identified by kid; up to two are active at once to allow zero-downtime rotation. This endpoint is public and requires no authentication.
This is a dedicated key set for Ephemeral Keys. It is unrelated to any other GoldRush signing key.

Endpoint

Request

No parameters, no authentication.

Example

Response

200 OK

Field descriptions

object[]
The set of active public signing keys. Standard JWK fields.

Usage

  • Cache the response and reuse it across verifications - it changes only on key rotation.
  • Select the key whose kid matches the kid in the token’s JWT header (not its claims), then verify the RS256 signature.
  • Refetch when you encounter an unknown kid - that signals a rotation. Keeping two keys active at once means in-flight tokens signed by the old key stay valid during the overlap.
Most integrators never call this endpoint directly - the GoldRush edge verifies Ephemeral Keys for you. It matters when you build your own verifier (for example, to check a token before opening a WebSocket).

Common errors

This endpoint is public and static; it does not return auth errors. A non-200 response indicates a transient outage - retry with backoff.