Receipt signing keys
GET
/v1/verify/keys
Returns the public keys (JWKS, ES256 on P-256) that check the receipt field of POST /v1/verify answers. The current key comes first; retired keys stay listed for at least 5 years, unless we withdraw a key after a security incident. No authentication required.
Responses
Section titled “ Responses ”OK
Media type application/json
object
keys
The current receipt key, then retired ones (kept for at least 5 years, unless we withdraw a key after a security incident).
Array<object> | null
object
alg
Always ES256.
string
crv
Curve.
string
kid
Key ID: the month the key started (YYYY-MM), with a short suffix for a second key in the same month.
string
kty
Key type.
string
use
Always sig.
string
x
X coordinate, base64url.
string
y
Y coordinate, base64url.
string