---
title: "Retrieve JSON Web Key Set (JWKS)"
method: GET
path: "/.well-known/study/jwks.json"
tags: ["wellKnownEndpoints"]
---

# Retrieve JSON Web Key Set (JWKS)

`GET /.well-known/study/jwks.json`

Fetches the public keys that can be used to verify JWTs signed by Prolific. Clients should cache these keys and update them at least daily.

To verify the signature of a JWT you must verify the following:
* The JWT signature is authentic by verifying it with the public key from Prolific that correlates with the KID.
* The JWT hasn't expired, by checking the `exp` claim.
* The `aud` claim is the correct domain for your tool.
* The `prolific` claim matches your expected payload as set in the `external_study_url` property. It always includes `workspace_id`. When the workspace is linked to an organisation, it also includes `organisation_id`.

## Response `200`

Successful response with the JWKS.

- JWKSResponse
  - `keys` JWK[]
    - `kty` 'RSA', required — Key type, always "RSA".
    - `kid` string, required — Key ID used to match the key to the JWT header.
    - `alg` 'RS256', required — Algorithm used, always "RS256".
    - `n` string, required — The modulus of the RSA public key.
    - `e` string, required — The exponent of the RSA public key.
    - `use` 'sig', required — The intended use of the public key.
    - `key_ops` JwkKeyOpsItems[], required — The operations that the key is intended to be used for.

---

[API](https://skmtc.net/prolific/apis/api-reference.md) · [All operations](https://skmtc.net/prolific/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/prolific/api-reference/versions/dc6f073a9827/schema)