Client's Public Key Retrieval

Originally submitted by Takahiko Kawasaki (Takahiko Kawasaki) on 2025-05-09

Are there any standards other than OpenID Federation that allow resource servers to retrieve a client’s public key? To verify an HTTP message signature in a resource request, the resource server needs the client application’s public key - that is, the counterpart to the private key used to sign the HTTP message. However, there is currently no standardized way for the resource server to obtain this public key. Has there been any discussion in the community about standardizing a method for retrieving clients' public keys?

As far as I know, OpenID Federation is currently the only standard that enables resource servers to retrieve client metadata (and subsequently the client’s public key via the jwks_uri property). However, adopting OpenID Federation is too heavy for most API systems, as it requires authorized third parties to operate trust anchors and intermediate authorities.

A straightforward solution to obtain the client’s public key might be to include a property - such as client_jwks_uri - in the introspection response that indicates the location of the client’s JWK Set. But I’m not sure if that’s an appropriate approach…

Bitbucket status: open

Bitbucket origin: issue 740

This is a standards and design discussion rather than a scoped implementation task. Start by reviewing the OpenID Federation and introspection approaches named in the issue, including jwks_uri and the proposed client_jwks_uri. Done would require a decided, documented approach for resource servers to retrieve clients’ public keys.