Get Signing Key

Retrieves an Ed25519 public key for verifying offline machine-file signatures and legacy offline-token signatures.

GET /api/v1/signing_keys/{key_id}

Note: This endpoint does not require authentication.

Try it in the Interactive API Docs →

When to Use

Fetching verification keys for machine files
Fetching verification keys for legacy offline tokens
Supporting key rotation
Dynamically loading unknown key IDs

Path Parameters

Parameter	Required	Description
`key_id`	Yes	Key ID from a machine file envelope `kid` or a legacy offline token `signature.key_id` / `token.kid`

Example Request

curl https://licenseseat.com/api/v1/signing_keys/org-xxx-offline-v1

No authentication required.

Response

{
  "object": "signing_key",
  "key_id": "org-xxx-offline-v1",
  "algorithm": "Ed25519",
  "public_key": "base64_encoded_32_byte_public_key=",
  "created_at": null,
  "status": "active"
}

Response Fields

Field	Description
`key_id`	Unique key identifier
`algorithm`	Signature algorithm (`Ed25519`)
`public_key`	Standard padded Base64 encoding of the raw 32-byte Ed25519 public key
`created_at`	Key creation time when supplied by the host; currently `null` in the Rails engine response
`status`	Key status; currently `active` for a successfully resolved key

Error Codes

Code	HTTP	Meaning
`signing_key_not_found`	404	Key ID doesn't exist
`resolver_not_configured`	500	The host application did not configure a public-key resolver
`resolver_data_invalid`	500	The resolver returned something other than a raw 32-byte key

Key Rotation

The token or machine-file kid is the routing key for rotation. The current LicenseSeat SaaS resolver exposes only the organization's exact configured key ID. If you implement rotation in another host application, its resolver must retain every retired public key for at least as long as artifacts signed by that key can remain valid.

Do not rotate key bytes in place while reusing a kid: SDKs cache public keys by ID, and existing artifacts would become unverifiable. Issue a new unique key ID, sign new artifacts with it, and keep the old public key resolvable through the retirement window.

Best Practices

Embed Known Keys

For performance and offline support, embed known public keys in your app:

const KNOWN_KEYS = {
  'org-xxx-offline-v1': 'base64_encoded_key_1=',
  'org-xxx-offline-v2': 'base64_encoded_key_2=',
};

async function getPublicKey(keyId) {
  // Use embedded key if known
  if (KNOWN_KEYS[keyId]) return KNOWN_KEYS[keyId];
  // Fetch unknown keys from API
  const response = await fetch(`/api/v1/signing_keys/${encodeURIComponent(keyId)}`);
  const data = await response.json();
  return data.public_key;
}

Security

Validate key length — Decoded key must be exactly 32 bytes
Require exact key IDs — Do not accept aliases that merely contain a real organization ID
Always verify signatures — Even with embedded keys
Handle new key IDs — Be prepared for key rotation
Use constant-time comparison — Prevent timing attacks