JWKS

The JSON Web Key Set (JWKS) endpoint exposes Elydora's public signing keys for independent verification of Elydora Acknowledgement Receipts (EARs).

Get JWKS

GET

/.well-known/elydora/jwks.json

Retrieve Elydora's public signing keys in JWKS format. No authentication required.

This endpoint is publicly accessible and requires no authentication. It follows the standard JWKS format defined in RFC 7517.

Example Request

bash

curl https://api.elydora.com/.well-known/elydora/jwks.json

Response

json

{
  "keys": [
    {
      "kty": "OKP",
      "crv": "Ed25519",
      "kid": "elydora-server-key-v1",
      "x": "<base64url public key>",
      "use": "sig",
      "alg": "EdDSA"
    }
  ]
}

Verification Usage

To verify a receipt, fetch the JWKS, pick the key whose kid matches elydora_kid, and verify the Ed25519 signature over the UTF-8 bytes of receipt_hash.

typescript

import { base64urlDecode } from '@elydora/sdk';

const { keys } = await (await fetch('https://api.elydora.com/.well-known/elydora/jwks.json')).json();
const jwk = keys.find((key) => key.kid === receipt.elydora_kid);
const publicKey = await crypto.subtle.importKey('jwk', jwk, { name: 'Ed25519' }, false, ['verify']);

// elydora_signature signs the UTF-8 bytes of receipt_hash
const valid = await crypto.subtle.verify(
  'Ed25519',
  publicKey,
  base64urlDecode(receipt.elydora_signature),
  new TextEncoder().encode(receipt.receipt_hash),
);