---
title: "Get the public keys used to verify webhook signatures"
method: GET
path: "/v1/.well-known/jwks.json"
tags: ["webhooks"]
---

# Get the public keys used to verify webhook signatures

`GET /v1/.well-known/jwks.json`

Returns the set of Ed25519 public keys Ideogram uses to sign outbound
webhook payloads. Customers verify incoming webhooks by recomputing the
canonical signed message (`request_id\nuser_id\ntimestamp\nsha256_hex(body)`)
and checking the `X-Ideogram-Webhook-Signature` header against any key
in this document.

The document includes the current signing key plus any keys recently
rotated out, so signatures already in flight remain verifiable across
rotations. Cache for up to 24 hours; refresh sooner if a signature
fails to verify against the cached set.

This endpoint is public and unauthenticated — no API key is required.

## Response `200`

JSON Web Key Set with the active webhook-signing keys.

- WebhookSigningJwks — JSON Web Key Set listing the Ed25519 public keys Ideogram uses to sign webhook payloads. Each entry follows RFC 7517 conventions for OKP keys.
  - `keys` WebhookSigningJwk[], required — Active and recently-rotated signing keys. A webhook is authentic if its signature verifies against any key in this list.
    - `kty` string, required — Key type. Always `"OKP"` for Ed25519.
    - `crv` string, required — Curve. Always `"Ed25519"`.
    - `x` string, required — The 32-byte public key, base64url-encoded without padding.
    - `kid` string, required — Opaque key identifier; stable across rotations of the same key.
    - `alg` string, required — Always `"EdDSA"`.
    - `use` string, required — Always `"sig"` (signing-only).

---

[API](https://skmtc.net/ideogram/apis/ideogram-openapi-3-0.md) · [All operations](https://skmtc.net/ideogram/apis/ideogram-openapi-3-0/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ideogram/ideogram-openapi-3-0/revisions/73707bc35f34/schema)