Get webhook JWKS
curl --request GET \
--url https://api.turnkey.com/public/v1/discovery/webhooks/jwksimport requests
url = "https://api.turnkey.com/public/v1/discovery/webhooks/jwks"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://api.turnkey.com/public/v1/discovery/webhooks/jwks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.turnkey.com/public/v1/discovery/webhooks/jwks",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.turnkey.com/public/v1/discovery/webhooks/jwks"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.turnkey.com/public/v1/discovery/webhooks/jwks")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.turnkey.com/public/v1/discovery/webhooks/jwks")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_body{
"keys": [
{
"kid": "<signing-key-id>",
"kty": "OKP",
"crv": "Ed25519",
"alg": "EdDSA",
"use": "sig",
"x": "<base64url-encoded-public-key>",
"turnkey_signature_algorithm": "ed25519",
"turnkey_signature_version": "v1"
}
]
}
Queries
Get webhook JWKS
Fetch Turnkey webhook signature verification keys.
GET
/
public
/
v1
/
discovery
/
webhooks
/
jwks
Get webhook JWKS
curl --request GET \
--url https://api.turnkey.com/public/v1/discovery/webhooks/jwksimport requests
url = "https://api.turnkey.com/public/v1/discovery/webhooks/jwks"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://api.turnkey.com/public/v1/discovery/webhooks/jwks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.turnkey.com/public/v1/discovery/webhooks/jwks",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.turnkey.com/public/v1/discovery/webhooks/jwks"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.turnkey.com/public/v1/discovery/webhooks/jwks")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.turnkey.com/public/v1/discovery/webhooks/jwks")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_body{
"keys": [
{
"kid": "<signing-key-id>",
"kty": "OKP",
"crv": "Ed25519",
"alg": "EdDSA",
"use": "sig",
"x": "<base64url-encoded-public-key>",
"turnkey_signature_algorithm": "ed25519",
"turnkey_signature_version": "v1"
}
]
}
Fetch the public Ed25519 keys used to verify Turnkey webhook signatures. This endpoint requires no authentication.
For full verification guidance, including signed message construction and SDK helper usage, see Verify webhook signatures.
Cache the JWKS response according to the
A successful response returns the following fields:
Cache-Control header. Match each JWK kid to the webhook delivery’s X-Turnkey-Signature-Key-Id header, and refetch JWKS before rejecting a delivery with an unknown kid.
Current production Cache-Control:
public, max-age=86400, s-maxage=86400, stale-if-error=604800
array
required
Public webhook signature verification keys.
Show keys details
Show keys details
{
"keys": [
{
"kid": "<signing-key-id>",
"kty": "OKP",
"crv": "Ed25519",
"alg": "EdDSA",
"use": "sig",
"x": "<base64url-encoded-public-key>",
"turnkey_signature_algorithm": "ed25519",
"turnkey_signature_version": "v1"
}
]
}
Was this page helpful?