---
title: "List issuer signing keys"
method: GET
path: "/v1/keys"
tags: ["Issuer Keys"]
---

# List issuer signing keys

`GET /v1/keys`

List your issuer signing keys and the JWKS (JSON Web Key Set) discovery URI. You use this endpoint to inspect active and rotated keys before or after a rotation. The service creates an active signing key on first use when none exists.

## Response `200`

You receive the tenant's signing keys and the JWKS (JSON Web Key Set) URI that verifiers use to discover public keys.

- object
  - `keys` object[] — Signing keys the tenant still publishes for verification. The list includes active and rotated keys, ordered newest first.
    - `id` string, uuid — Internal UUID of the signing-key record.
    - `kid` string — JWK (JSON Web Key) key identifier for the public signing key. The service places this `kid` in each SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) header so verifiers can select the right public key.
    - `alg` 'ES256' — JSON Web Signature algorithm used by this key.
    - `status` 'active' | 'rotated' — Key lifecycle state. `active` signs new credentials. `rotated` verifies credentials signed before rotation.
    - `is_active` boolean — Whether this key is the current signing key.
    - `valid_until` string, date-time, nullable — Timestamp until which a rotated key remains valid for verification. Active keys return null.
    - `created_at` string, date-time — Timestamp when the signing key was created.
  - `jwks_uri` string, uri — Absolute JWKS (JSON Web Key Set) discovery URL for this tenant. The document exposes public JWK (JSON Web Key) values for active and rotated keys.

---

[API](https://skmtc.net/didit-protocol/apis/didit-credentials-api.md) · [All operations](https://skmtc.net/didit-protocol/apis/didit-credentials-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/didit-protocol/didit-credentials-api/revisions/e4eddba66557/schema)