---
title: "Get the IDaaS public encryption key"
method: GET
path: "/v1/keys/idaas"
tags: ["Encryption"]
---

# Get the IDaaS public encryption key

`GET /v1/keys/idaas`

Returns the IDaaS EC P-256 public key in two formats:
- **`jwk`** – JSON Web Key (JWK) format; import directly into any JOSE library.
- **`publicKeyBase64`** – Base64-encoded X.509 (SubjectPublicKeyInfo) DER; use with
  `KeyFactory.getInstance("EC").generatePublic(new X509EncodedKeySpec(decoded))` in Java.

Use this key to **encrypt request payloads** before sending them to IDaaS:
```
1. Serialize your JSON request body.
2. Encrypt with JWE (alg=ECDH-ES+A256KW, enc=A256GCM) using this public key.
3. Set header: Content-Encryption: JWE
4. Send the JWE compact string as the request body.
```

This endpoint is **unauthenticated** – public keys are safe to distribute.
Cache the response; refresh only if you encounter a JWE decryption error (HTTP 400).

## Response `200`

IDaaS public key returned

---

[API](https://skmtc.net/reflexpay/apis/idaas-identity-as-a-service-api.md) · [All operations](https://skmtc.net/reflexpay/apis/idaas-identity-as-a-service-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/reflexpay/idaas-identity-as-a-service-api/revisions/db1f954badfb/schema)