Code in

Signing keys (JWKS)

The public keys that sign ID tokens and access tokens, as a JSON Web Key Set.

Melden Sie sich an, um Ihre eigene Test-Client-ID in den Beispielen zu sehen.

GET https://accounts.aton-network.org/.well-known/jwks.json

When to use it

Your JOSE library reads it to check token signatures. Fetch it again when a token names a kid you do not have.

Authentication

None. It is public.

Parameters

None.

Request

# The public keys that sign ID tokens and access tokens (ES256), matched on kid.
curl https://accounts.aton-network.org/.well-known/jwks.json

Response

http

HTTP 200
content-type: application/json
cache-control: public, max-age=300, stale-while-revalidate=86400

{
  "keys": [
    { "kty": "EC", "crv": "P-256", "alg": "ES256", "use": "sig", "kid": "2026-10-01", "x": "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU", "y": "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0" }
  ]
}

Errors

This endpoint returns no errors of its own; a fault at our end is a 5xx.

Good to know

Tokens are signed with ES256 only. Refuse any other alg, and never accept alg none.
Keys rotate with an overlap: a new key appears in the set before anything is signed with it.

Security

Match on kid, and refuse a token whose kid is not in the set after one refresh of it.

Fragen Sie Atlas

KI-Assistent

Fragen Sie alles zu Mit Atheron anmelden, zur API oder zum Portal. Die Antwort kommt aus unserer Dokumentation, mit Links zu den genutzten Seiten.