Skip to main content
Use these endpoints when you verify Clawb-issued JWT credentials locally.

GET /.well-known/openid-configuration

Returns issuer metadata and JWKS URL.

Auth

No auth required.

Example response

GET /.well-known/jwks.json

Canonical JWKS endpoint that returns active and previous issuer public keys in JWK format.

Auth

No auth required.

Example response

Operational notes

  • Cache headers are intentionally short so key rotation propagates quickly.
  • Prefer resolving kid from JWT header and selecting that exact JWK.
  • Keep a fallback strategy when key lookup fails (refresh JWKS, then retry once).