Where are ClearRun's public signing keys? (/.well-known/jwks.json)

At https://api.clearrun.net/.well-known/jwks.json. It lists ClearRun's public Ed25519 signing keys. Match a receipt's keyId to a key's kid to check its signature.

Last updated

Steps

  1. Fetch the keys

    curl -s https://api.clearrun.net/.well-known/jwks.json

  2. Find the matching key

    Each key has kid, kty (OKP), crv (Ed25519), alg (EdDSA) and x. Pick the one whose kid equals the receipt's keyId.

Why it is public

So anyone can check a receipt without asking ClearRun. See How to check a ClearRun receipt signature yourself.

Keep a copy

Audit exports include the key set, so an exported bundle can be checked offline later.