List jwks

Publishes the Ed25519 PUBLIC verification key, at both /pubkey and /jwks.

GET /v1/licensing/jwks

Licensing → · All API references → · Get started →

Address	`https://api.hanzo.ai/v1/licensing/jwks`
Method	`GET`
Operation	`get_licensing_jwks`
Auth	`Authorization: Bearer $HANZO_API_KEY`

Publishes the Ed25519 PUBLIC verification key, at both /pubkey and /jwks.

This is the only public-safe surface here and the reason the whole scheme works offline: the engine embeds or fetches this key once and then verifies every license itself, with no call home per launch. The private half lives in KMS, so nothing served here is a secret. provider names where that half lives: "kms" is the production key every engine embeds; "local" is a development key, and a token signed by one is not a production credential.

Request

GET /v1/licensing/jwks takes no parameters and no body — the credential is the whole request.

Response

Status	Body	Meaning
`200`	licensing.PubkeyView	ok
`default`	problem-details	refused

200 body — 10 fields.

Field	In	Type	Always	Description
`alg`	body	string	—	Alg is always "Ed25519".
`keys`	body	licensing.JWK[]	—	Keys is the same key as a single-entry JWKS (OKP/Ed25519), for JWKS-shaped consumers.
`keys[].crv`	body	string	—	Crv is always "Ed25519".
`keys[].kty`	body	string	—	Kty is always "OKP".
`keys[].use`	body	string	—	Use is always "sig".
`keys[].x`	body	string	—	X is the public key, base64url (the JWK convention).
`provider`	body	string	—	Provider names where the private half lives: "kms" (production) or "local" (a development key — never trust it in production).
`public_key`	body	string	—	PublicKey is the 32-byte Ed25519 public key, standard base64.
`schema`	body	integer (uint8)	—	Schema is the license payload schema version this key signs.
`token_format`	body	string	—	TokenFormat states the wire layout so an implementer can verify a token without this service's source.

Failure carries the platform error shape — see Errors.

Examples

CLI

SDK

HTTP

MCP

hanzo licensing jwks

.ts

.py

.go

.rs

.java

import { Configuration, LicensingApi } from 'hanzoai';

const api = new LicensingApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getLicensingJwks();

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import LicensingApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = LicensingApi(client).get_licensing_jwks()

cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.LicensingAPI.GetLicensingJwks(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_client::apis::{configuration::Configuration, licensing_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = licensing_api::get_licensing_jwks(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.LicensingApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new LicensingApi(client).getLicensingJwks();

curl https://api.hanzo.ai/v1/licensing/jwks \
  -H "Authorization: Bearer $HANZO_API_KEY"

MCP reaches licensing through the licensing tool, which names its 9 operations with its own verbs — this one among them, under a name only MCP declares. describe explains any of them:

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "get_licensing_download"
         }
       }
     }'

Licensing API · All Hanzo APIs · Interactive reference

Was this page useful?

PreviousList healthz NextList pubkey