Skip to content
AtheronDEVELOPERS
← API reference

Signing keys (JWKS)

The public keys that sign ID tokens and access tokens, as a JSON Web Key Set.

Sign in to see your own test client ID in the samples.

GET https://accounts.aton-network.org/.well-known/jwks.json

When to use it

Your JOSE library reads it to check token signatures. Fetch it again when a token names a kid you do not have.

Authentication

None. It is public.

Parameters

None.

Request

# The public keys that sign ID tokens and access tokens (ES256), matched on kid.
curl https://accounts.aton-network.org/.well-known/jwks.json

Response

http
HTTP 200
content-type: application/json
cache-control: public, max-age=300, stale-while-revalidate=86400

{
  "keys": [
    { "kty": "EC", "crv": "P-256", "alg": "ES256", "use": "sig", "kid": "2026-10-01", "x": "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU", "y": "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0" }
  ]
}

Errors

This endpoint returns no errors of its own; a fault at our end is a 5xx.

Good to know

  • Tokens are signed with ES256 only. Refuse any other alg, and never accept alg none.
  • Keys rotate with an overlap: a new key appears in the set before anything is signed with it.

Security

  • Match on kid, and refuse a token whose kid is not in the set after one refresh of it.

Ask Atlas

AI assistant

Ask anything about Sign in with Atheron, the API or the portal. You get an answer from our docs, with links to the pages it used.