API Endpoint

GET /management/offline/signing-keys

List offline JWT signing keys and their lifecycle state.

GET /management/offline/signing-keys

Endpoint context

Use these endpoints from internal tooling or your frontend backend to inspect licenses, manage slug policy templates, provisioning API keys, webhook endpoint configuration/logs, and offline JWT signing keys. Management routes require the management bootstrap key configured via MANAGEMENT_API_KEYS or MANAGEMENT_API_KEY.

Requires management API key auth.
Private key material is never returned.
Use this endpoint for the Offline Licenses management UI and operator audits.

bash

curl -sS http://localhost:8080/management/offline/signing-keys   -H "Authorization: Bearer management_key_dev_123456"

Request body

json

{} (no request body)

Response body

json

{
  "signing_keys": [
    {
      "id": 1,
      "name": "desktop-app-2026",
      "kid": "61426d843cf40341f68a3053",
      "algorithm": "Ed25519",
      "status": "active",
      "created_at": "2026-04-21T12:00:00Z",
      "activated_at": "2026-04-21T12:05:00Z",
      "retired_at": null
    }
  ]
}

Response field types

signing_keys

array

Signing key metadata records.

signing_keys[].kid

string

JWT key id emitted in the token header.

signing_keys[].algorithm

"Ed25519"

Signing algorithm for this key.

signing_keys[].status

"active" | "verify_only" | "retired"

Lifecycle state. Only active signs new tokens.

Error codes

401

Missing or invalid management API key.

500

Unexpected server or storage error.

Back to API overview