JWKS API

`GET /.well-known/jwks.json`

Unauthenticated by design — a resource server must be able to verify a hop token offline, with zero calls back to the control plane on the hot path. Returns the issuer's public key set in standard JWK Set format; no private key material is ever served.

Response — 200:

{
  "keys": [
    {"kty": "OKP", "crv": "Ed25519", "kid": "...", "x": "..."}
  ]
}

This is the same key set an offline verifier pins for the Identity Registry / Verifier's trust anchor once identity enforcement ships.

Token Exchange Service — mints the tokens this key set verifies
Token API

GET /.well-known/jwks.json​

Related​

`GET /.well-known/jwks.json`

Related