Skip to content

Obtain Key Set Using JSON Web Key Set

The JSON Web Key Set (JWKS) endpoint is a read-only endpoint that returns the Identity Server's public key set in the JWKS format.

You can follow this guide when your relying party (RP) application needs to validate JWT Token signatures issued by WSO2 Identity Server.


Endpoint URL for super tenant

Copy and paste the following endpoint URL on your browser window.

URL Format

https://<IS_HOST>:<IS_HTTPS_PORT>/oauth2/jwks


Sample URL

https://localhost:9443/oauth2/jwks

  • By default, <IS_HOST> is localhost. However, if you are using a public IP, the respective IP address or domain needs to be specified.

  • By default, <IS_HTTPS_PORT> has been set to 9443. However, if the port offset has been incremented by n , the default port value needs to be incremented by n as well.

You will see the following response.

Response

{
    "keys": [
        {
        "kty": "RSA",
        "e": "AQAB",
        "use": "sig",
        "kid": "NTAxZmMxNDMyZDg3MTU1ZGM0MzEzODJhZWI4NDNlZDU1OGFkNjFiMQ",
        "alg": "RS256",
        "n": "luZFdW1ynitztkWLC6xKegbRWxky-5P0p4ShYEOkHs30QI2VCuR6Qo4Bz5rTgLBrky03W1GAVrZxuvKRGj9V9-PmjdGtau4CTXu9pLLcqnruaczoSdvBYA3lS9a7zgFU0-s6kMl2EhB-rk7gXluEep7lIOenzfl2f6IoTKa2fVgVd3YKiSGsyL4tztS70vmmX121qm0sTJdKWP4HxXyqK9neolXI9fYyHOYILVNZ69z_73OOVhkh_mvTmWZLM7GM6sApmyLX6OXUp8z0pkY-vT_9-zRxxQs7GurC4_C1nK3rI_0ySUgGEafO1atNjYmlFN-M3tZX6nEcA6g94IavyQ"
        }
    ]
}

For information about the elements in the response, see Response parameters.


Endpoint URL for tenants

Copy and paste the following endpoint URL on your browser window.

URL Format

https://<IS_HOST>:<IS_PORT>/t/<TENANT_DOMAIN>/oauth2/jwks


Sample URL

https://localhost:9443/t/foo.com/oauth2/jwks

  • By default, <IS_HOST> is localhost. However, if you are using a public IP, the respective IP address or domain needs to be specified.

  • By default, <IS_HTTPS_PORT> has been set to 9443. However, if the port offset has been incremented by n , the default port value needs to be incremented by n as well.

You will see the following response.

Response

{
    "keys": [
        {
        "kty": "RSA",
        "e": "AQAB",
        "use": "sig",
        "kid": "MTk5NjA3YjRkNGRmZmI4NTYyMzEzZWFhZGM1YzAyZWMyZTg0ZGQ4Yw",
        "alg": "RS256",
        "n": "0OA-yiyn_pCKnldZBq2KPnGplLuTEtGU7IZP66Wf7ElhFJ-kQ87BMKvZqVNDV84MSY3XQg0t0yL6gITg-W8op61PWO2UrEcxhhMHN_rra22Ae2OCaUfOr43cW1YFc54cYj5p7v-HSVvjTuNLGMMrNfTGAOCPzuLxbSHfq62uydU"
        }
    ]
}

For information about the elements in the response, see Response parameters.


Response parameters

Property value description
kty The public key type.
e The exponent value of the public key.
use

Implies how the key is being used. The value sig represents signature.

kid The thumbprint of the certificate. This value is used to identify the key that needs to be used to verify the signature.
alg

The algorithm used to secure the JSON Web Signature.

n The modulus value of the public key.

For more information, see the JWKS specification.

Top