PediID Keys

GET PediID's published signing keys

GET /id/.well-known/jwks.json

The JSON Web Key Set an integrator uses to verify a PediID id_token. Unauthenticated by necessity: a verifier holds no PediID credential, and the response is public information - it carries only public halves. Every key that is not RETIRED is listed, which is broader than 'the key that signs today' and deliberately so. A key appears here BEFORE it begins signing, so a verifier caching this document has already seen it, and stays here AFTER it stops signing, because tokens it signed are still alive. Match the token header's kid against this list rather than assuming a single key.

Headers

Example

Response: JsonWebKeySetResponse

curl -X GET "https://api.bridgemoni.com/id/.well-known/jwks.json" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "keys": [
    {
      "kid": "string",
      "kty": "string",
      "crv": "string",
      "alg": "string",
      "use": "string",
      "x": "string",
      "y": "string"
    }
  ]
}

Responses