# List pubkey

URL: https://docs.hanzo.ai/docs/openapi/licensing/get-licensing-pubkey

> Publishes the Ed25519 PUBLIC verification key, at both /pubkey and /jwks.

`GET /v1/licensing/pubkey`

> [Licensing →](https://docs.hanzo.ai/docs/openapi/licensing) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides)

|               |                                            |
| ------------- | ------------------------------------------ |
| **Address**   | `https://api.hanzo.ai/v1/licensing/pubkey` |
| **Method**    | `GET`                                      |
| **Operation** | `get_licensing_pubkey`                     |
| **Auth**      | `Authorization: Bearer $HANZO_API_KEY`     |

Publishes the Ed25519 PUBLIC verification key, at both /pubkey and
/jwks.

This is the only public-safe surface here and the reason the whole scheme
works offline: the engine embeds or fetches this key once and then verifies
every license itself, with no call home per launch. The private half lives in
KMS, so nothing served here is a secret. `provider` names where that half
lives: `"kms"` is the production key every engine embeds; `"local"` is a
development key, and a token signed by one is not a production credential.

## Request

`GET /v1/licensing/pubkey` takes no parameters and no body — the credential is the whole request.

## Response

| Status    | Body                 | Meaning |
| --------- | -------------------- | ------- |
| `200`     | licensing.PubkeyView | ok      |
| `default` | problem-details      | refused |

`200` body — 10 fields.

| Field          | In   | Type             | Always | Description                                                                                                                    |
| -------------- | ---- | ---------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------ |
| `alg`          | body | string           | —      | Alg is always "Ed25519".                                                                                                       |
| `keys`         | body | licensing.JWK\[] | —      | Keys is the same key as a single-entry JWKS (OKP/Ed25519), for JWKS-shaped consumers.                                          |
| `keys[].crv`   | body | string           | —      | Crv is always "Ed25519".                                                                                                       |
| `keys[].kty`   | body | string           | —      | Kty is always "OKP".                                                                                                           |
| `keys[].use`   | body | string           | —      | Use is always "sig".                                                                                                           |
| `keys[].x`     | body | string           | —      | X is the public key, base64url (the JWK convention).                                                                           |
| `provider`     | body | string           | —      | Provider names where the private half lives: "kms" (production) or "local" (a development key — never trust it in production). |
| `public_key`   | body | string           | —      | PublicKey is the 32-byte Ed25519 public key, standard base64.                                                                  |
| `schema`       | body | integer (uint8)  | —      | Schema is the license payload schema version this key signs.                                                                   |
| `token_format` | body | string           | —      | TokenFormat states the wire layout so an implementer can verify a token without this service's source.                         |

Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors).

## Examples

**CLI**

```bash
hanzo licensing pubkey
```

**SDK**

**.ts**

```ts
import { Configuration, LicensingApi } from 'hanzoai';

const api = new LicensingApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getLicensingPubkey();
```

**.py**

```python
from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import LicensingApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = LicensingApi(client).get_licensing_pubkey()
```

**.go**

```go
cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.LicensingAPI.GetLicensingPubkey(context.Background()).Execute()
if err != nil {
	return err
}
```

**.rs**

```rust
use hanzo_client::apis::{configuration::Configuration, licensing_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = licensing_api::get_licensing_pubkey(&cfg, Default::default()).await?;
```

**.java**

```java
import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.LicensingApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new LicensingApi(client).getLicensingPubkey();
```

**HTTP**

```bash
curl https://api.hanzo.ai/v1/licensing/pubkey \
  -H "Authorization: Bearer $HANZO_API_KEY"
```

**MCP**

Tool `licensing`, op `get_licensing_pubkey` — POST the JSON-RPC envelope to `https://api.hanzo.ai/v1/mcp`.

```bash
curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "licensing",
         "arguments": {
           "op": "get_licensing_pubkey",
           "input": {}
         }
       }
     }'
```

---

[Licensing API](https://docs.hanzo.ai/docs/openapi/licensing) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)