> ## Documentation Index
> Fetch the complete documentation index at: https://goldrush.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Get the Ephemeral JWKS

> Fetch the public JSON Web Key Set used to sign Ephemeral Keys, so any verifier can validate a gr_ek_ token's signature offline.

<CardGroup cols={2}>
  <Card title="Credential"> None (public)</Card>
  <Card title="Processing"> Realtime</Card>
</CardGroup>

Returns the JSON Web Key Set of **public** keys used to sign Ephemeral Keys. Any verifier - including the GoldRush edge - uses it to validate a `gr_ek_…` token's signature **offline**, without a round-trip to the control plane. Keys are identified by `kid`; up to two are active at once to allow zero-downtime rotation.

This endpoint is **public** and requires no authentication.

<Note>
  This is a **dedicated** key set for Ephemeral Keys. It is unrelated to any other GoldRush signing key.
</Note>

## Endpoint

```
GET https://api.covalenthq.com/platform/.well-known/ephemeral-jwks.json
```

## Request

No parameters, no authentication.

### Example

<CodeGroup>
  ```bash cURL theme={null}
  curl "https://api.covalenthq.com/platform/.well-known/ephemeral-jwks.json"
  ```

  ```typescript TypeScript theme={null}
  const response = await fetch(
    "https://api.covalenthq.com/platform/.well-known/ephemeral-jwks.json",
  );

  const jwks = await response.json();
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      "https://api.covalenthq.com/platform/.well-known/ephemeral-jwks.json",
  )
  response.raise_for_status()

  jwks = response.json()
  ```
</CodeGroup>

## Response

`200 OK`

```json theme={null}
{
  "keys": [
    {
      "kty": "RSA",
      "use": "sig",
      "alg": "RS256",
      "kid": "ek-2026-08a",
      "n": "…",
      "e": "AQAB"
    }
  ]
}
```

### Field descriptions

<ResponseField name="keys" type="object[]">
  The set of active public signing keys. Standard JWK fields.

  <Expandable title="keys[]">
    <ResponseField name="kty" type="string">Key type. Always `RSA`.</ResponseField>
    <ResponseField name="use" type="string">Intended use. Always `sig` (signature verification).</ResponseField>
    <ResponseField name="alg" type="string">Algorithm. Always `RS256`.</ResponseField>
    <ResponseField name="kid" type="string">Key id. Matches the `kid` in an Ephemeral Key's JWT header; use it to select the right key.</ResponseField>
    <ResponseField name="n" type="string">RSA modulus (base64url).</ResponseField>
    <ResponseField name="e" type="string">RSA public exponent (base64url), typically `AQAB`.</ResponseField>
  </Expandable>
</ResponseField>

## Usage

* **Cache the response** and reuse it across verifications - it changes only on key rotation.
* Select the key whose `kid` matches the `kid` in the token's **JWT header** (not its claims), then verify the RS256 signature.
* **Refetch when you encounter an unknown `kid`** - that signals a rotation. Keeping two keys active at once means in-flight tokens signed by the old key stay valid during the overlap.

Most integrators never call this endpoint directly - the GoldRush edge verifies Ephemeral Keys for you. It matters when you build your own verifier (for example, to check a token before opening a WebSocket).

## Common errors

This endpoint is public and static; it does not return auth errors. A non-`200` response indicates a transient outage - retry with backoff.