Get the Ephemeral JWKS
Ephemeral Keys
Get the Ephemeral JWKS
Fetch the public JSON Web Key Set used to sign Ephemeral Keys, so any verifier can validate a gr_ek_ token’s signature offline.
GET
Get the Ephemeral JWKS
Credential
None (public)
Processing
Realtime
gr_ek_… token’s signature offline, without a round-trip to the control plane. Keys are identified by kid; up to two are active at once to allow zero-downtime rotation.
This endpoint is public and requires no authentication.
This is a dedicated key set for Ephemeral Keys. It is unrelated to any other GoldRush signing key.
Endpoint
Request
No parameters, no authentication.Example
Response
200 OK
Field descriptions
object[]
The set of active public signing keys. Standard JWK fields.
Usage
- Cache the response and reuse it across verifications - it changes only on key rotation.
- Select the key whose
kidmatches thekidin the token’s JWT header (not its claims), then verify the RS256 signature. - Refetch when you encounter an unknown
kid- that signals a rotation. Keeping two keys active at once means in-flight tokens signed by the old key stay valid during the overlap.
Common errors
This endpoint is public and static; it does not return auth errors. A non-200 response indicates a transient outage - retry with backoff.