---
title: "JSON Web Key Set"
method: GET
path: "/oauth/keys"
tags: ["Authentication"]
---

# JSON Web Key Set

`GET /oauth/keys`

This contains the signing key(s) the RP uses to validate signatures from the OP.

## Response `200`

ok

- JoseJSONWebKeySet
  - `keys` JoseJSONWebKey[], required
    - `Algorithm` string, required
    - `CertificateThumbprintSHA1` string, required
    - `CertificateThumbprintSHA256` string, required
    - `Certificates` X509Certificate[], required
      - `AuthorityKeyId` string, required
      - `BasicConstraintsValid` boolean, required
      - `CRLDistributionPoints` string[], required
      - `DNSNames` string[], required
      - `EmailAddresses` string[], required
      - `ExcludedDNSDomains` string[], required
      - `ExcludedEmailAddresses` string[], required
      - `ExcludedIPRanges` NetIPNet[], required
        - `IP` string, required
        - `Mask` string, required
      - `ExcludedURIDomains` string[], required
      - `ExtKeyUsage` integer[], required
      - `Extensions` PkixExtension[], required
        - `Critical` boolean, required
        - `Id` integer[], required
        - `Value` string, required
      - `ExtraExtensions` PkixExtension[], required
        - `Critical` boolean, required
        - `Id` integer[], required
        - `Value` string, required
      - `IPAddresses` string[], required
      - `IsCA` boolean, required
      - `Issuer` PkixName, required
        - `CommonName` string, required
        - `Country` string[], required
        - `ExtraNames` PkixAttributeTypeAndValue[], required
          - `Type` integer[], required
          - `Value` unknown, required
        - `Locality` string[], required
        - `Names` PkixAttributeTypeAndValue[], required
          - `Type` integer[], required
          - `Value` unknown, required
        - `Organization` string[], required
        - `OrganizationalUnit` string[], required
        - `PostalCode` string[], required
        - `Province` string[], required
        - `SerialNumber` string, required
        - `StreetAddress` string[], required
      - `IssuingCertificateURL` string[], required
      - `KeyUsage` integer, required
      - `MaxPathLen` integer, required
      - `MaxPathLenZero` boolean, required
      - `NotAfter` string, date-time, required
      - `NotBefore` string, date-time, required
      - `OCSPServer` string[], required
      - `PermittedDNSDomains` string[], required
      - `PermittedDNSDomainsCritical` boolean, required
      - `PermittedEmailAddresses` string[], required
      - `PermittedIPRanges` NetIPNet[], required
        - `IP` string, required
        - `Mask` string, required
      - `PermittedURIDomains` string[], required
      - `Policies` X509OID[], required
        - `der` string, required
      - `PolicyIdentifiers` array[], required
        - integer[]
      - `PublicKey` unknown, required
      - `PublicKeyAlgorithm` integer, required
      - `Raw` string, required
      - `RawIssuer` string, required
      - `RawSubject` string, required
      - `RawSubjectPublicKeyInfo` string, required
      - `RawTBSCertificate` string, required
      - `SerialNumber` string, required
      - `Signature` string, required
      - `SignatureAlgorithm` integer, required
      - `Subject` PkixName, required
        - `CommonName` string, required
        - `Country` string[], required
        - `ExtraNames` PkixAttributeTypeAndValue[], required
          - `Type` integer[], required
          - `Value` unknown, required
        - `Locality` string[], required
        - `Names` PkixAttributeTypeAndValue[], required
          - `Type` integer[], required
          - `Value` unknown, required
        - `Organization` string[], required
        - `OrganizationalUnit` string[], required
        - `PostalCode` string[], required
        - `Province` string[], required
        - `SerialNumber` string, required
        - `StreetAddress` string[], required
      - `SubjectKeyId` string, required
      - `URIs` UrlURL[], required
        - `ForceQuery` boolean, required
        - `Fragment` string, required
        - `Host` string, required
        - `OmitHost` boolean, required
        - `Opaque` string, required
        - `Path` string, required
        - `RawFragment` string, required
        - `RawPath` string, required
        - `RawQuery` string, required
        - `Scheme` string, required
        - `User` UrlUserinfo, required
          - `password` string, required
          - `passwordSet` boolean, required
          - `username` string, required
      - `UnhandledCriticalExtensions` array[], required
        - integer[]
      - `UnknownExtKeyUsage` array[], required
        - integer[]
      - `Version` integer, required
    - `CertificatesURL` UrlURL, required
      - `ForceQuery` boolean, required
      - `Fragment` string, required
      - `Host` string, required
      - `OmitHost` boolean, required
      - `Opaque` string, required
      - `Path` string, required
      - `RawFragment` string, required
      - `RawPath` string, required
      - `RawQuery` string, required
      - `Scheme` string, required
      - `User` UrlUserinfo, required
        - `password` string, required
        - `passwordSet` boolean, required
        - `username` string, required
    - `Key` unknown, required
    - `KeyID` string, required
    - `Use` string, required

---

[API](https://skmtc.net/kubesphere/apis/ks-api.md) · [All operations](https://skmtc.net/kubesphere/apis/ks-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kubesphere/ks-api/versions/0451c8cec9b1/schema)