# Keys (JWKS)

Ed25519 JWKS for verifying signed envelopes

## GET /v1/keys {#v1jwks}

Fetch the current Ed25519 JWKS

No `shield_key` required — public by design (docs/partners fetch this endpoint without authentication). An optional valid `shield_key` attributes that fetch to the key purely for go-live tracking; a missing/invalid key is still served the JWKS, just uncounted. Canonical URL: `https://keys.vkl-shield.com/v1/keys` (live) / `https://keys.vkl-shield.com/sandbox/v1/keys` (sandbox) — never a shield/park host. `Cache-Control: public, max-age=600`; honor it and drop any kid absent from a fresh fetch. Fails closed (503 `SIGNING_UNAVAILABLE`, `no-store`) rather than ever serving an empty/untrustworthy key set.