JWKS
The embed signing keys, published.
packages/api/src/embed/jwks.controller.ts by packages/docs/tools/generate-reference.mjs. Do not edit by hand: src/reference.spec.ts regenerates it and fails on a difference.The embed-token signing keys, in the one place a standard JWT library looks for them.
Unauthenticated on purpose, and safe to be: EmbedTokenService.jwks() builds
its answer from SigningKey.jwk(), which has no branch that reaches private
material. Publishing it is what report section 7.2 means by "the public key
stays publishable so the component can pre-validate without a round trip",
and it is what makes a quarterly rotation (section 7.4) something a
customer's own verifier follows on its own: the new kid appears here before
any token carries it.
A deployment with no signing key configured answers {"keys": []} rather
than 404. "The embed plane is off here" is a fact worth serving; a 404 reads
as "wrong URL" and sends an integrator looking for a different path.
GET /.well-known/jwks.json
Answers 200 on success.
Authentication.
- No credential.