> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scute.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Get RSA public key for JWT verification

> Returns the RSA public key for JWT token verification. This endpoint is PUBLIC and requires no authentication.

**Why this endpoint is public:**
- Required for JWT verification by client applications
- Follows OAuth2/OIDC standards where JWKS endpoints are public
- Avoids chicken-and-egg problem (clients need keys to verify tokens)
- Only exposes public keys, no sensitive data

The endpoint delegates to the app's workspace key infrastructure.




## OpenAPI

````yaml /swagger.json get /v1/auth/{app_id}/public_key
openapi: 3.0.1
info:
  title: Scute API
  version: v1
  description: API for managing users in Scute applications
servers:
  - url: https://{defaultHost}
    variables:
      defaultHost:
        default: api.scute.io
  - url: http://localhost:3333
    description: Development server
security:
  - apiSecret: []
    userAccess: []
paths:
  /v1/auth/{app_id}/public_key:
    parameters:
      - name: app_id
        in: path
        required: true
        description: App ID
        schema:
          type: string
    get:
      tags:
        - RSA Keys
      summary: Get RSA public key for JWT verification
      description: >
        Returns the RSA public key for JWT token verification. This endpoint is
        PUBLIC and requires no authentication.


        **Why this endpoint is public:**

        - Required for JWT verification by client applications

        - Follows OAuth2/OIDC standards where JWKS endpoints are public

        - Avoids chicken-and-egg problem (clients need keys to verify tokens)

        - Only exposes public keys, no sensitive data


        The endpoint delegates to the app's workspace key infrastructure.
      operationId: getAppPublicKey
      responses:
        '200':
          description: successful
          content:
            application/json:
              schema:
                type: object
                properties:
                  public_key:
                    type: string
                    description: PEM-formatted RSA public key for JWT verification
                    example: |-
                      -----BEGIN PUBLIC KEY-----
                      MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMI...
                  key_id:
                    type: string
                    description: Unique key identifier for JWT verification (kid header)
                    example: ws_123_1640995200
                  algorithm:
                    type: string
                    description: JWT signing algorithm used by this key
                    example: RS256
                  workspace_id:
                    type: string
                    description: Workspace ID that owns this key
                    example: ws_123
                  generated_at:
                    type: string
                    format: datetime
                    description: When the key was generated
                    example: '2024-01-01T12:00:00Z'
                required:
                  - public_key
                  - key_id
                  - algorithm
                  - workspace_id
                  - generated_at
        '404':
          description: app not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: App not found
                  error_code:
                    type: string
                    example: app_not_found
        '503':
          description: RSA keys not available
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: RSA keys not available
                  error_code:
                    type: string
                    example: keys_not_available
      security: []
components:
  securitySchemes:
    apiSecret:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: API Secret token
    userAccess:
      type: apiKey
      name: X-Authorization
      in: header
      description: User Access token

````