Skip to content
    TimeLogic API logoTimeLogic API
    Sign in
    Endpoint guide

    Public signing key (JWKS)

    GET /.well-known/time-api-public-keyOpenAPI YAML

    JWKS document containing the Ed25519 public key used to verify signed responses.

    Code samples

    Copy a request in your preferred language and replace YOUR_TIMELOGIC_API_KEY with your direct API key.

    curl "https://api.timelogicapi.com/.well-known/time-api-public-key"

    Example response

    {
  "keys": [
    {
      "kty": "OKP",
      "crv": "Ed25519",
      "alg": "EdDSA",
      "use": "sig",
      "key_ops": ["verify"],
      "ext": true,
      "kid": "ed25519-2026-07-19",
      "x": "LUuZFwpGBGvPS-4vJdLM21_IreJqea-aoyXRhGfH3dI"
    }
  ]
}
    Additional endpoint notes

    Returned as application/json. Cache the JWKS and rotate when a new kid appears.

    When you request a signed response (sign=true), the API returns these headers:

    • X-TimeLogic-Key-Id — JWKS kid to look up.
    • X-TimeLogic-Signature-Alg — currently Ed25519.
    • X-TimeLogic-Signature-Timestamp — Unix seconds when the signature was produced.
    • X-TimeLogic-Content-SHA256 — base64 SHA-256 of the response body.
    • X-TimeLogic-Signature-Input — Base64URL-encoded exact UTF-8 v1 envelope.
    • X-TimeLogic-Signature — base64 Ed25519 signature over the decoded X-TimeLogic-Signature-Input bytes.

    Verify by recomputing the SHA-256 of the body, comparing it to content-sha256 inside the decoded envelope, and validating the Ed25519 signature with the JWKS key matching the envelope kid. Do not rebuild the envelope.

    When to use this endpoint

    Use Public signing key (JWKS) when you request signed TimeLogic responses and need to verify response integrity. It is intended for clients that require tamper-evidence across proxies, logs, or downstream services.

    Request model

    Fetch the JWKS document and cache it by kid. When a signed API response arrives, decode X-TimeLogic-Signature-Input and use its kid to select the correct public key before verifying the signature.

    Verification guidance

    The v1 envelope signs status, method, origin-form path plus query, timestamp, and body hash. It deliberately excludes scheme, host, and Content-Type, so clients can verify a response through either the RapidAPI proxy host or gateway host without rebuilding host-dependent bytes. Rotate cached keys when a new kid appears.

    Try it on the site: the signed-response verifier runs entirely in your browser — paste a response body and the X-TimeLogic-* headers, pick the kid, and check the signature without sending anything to a server.