Skip to content
Sill Docs

Public JWKS

Sill publishes the public half of its edge signing key at a standard JWKS (JSON Web Key Set) endpoint. Any third party can fetch the JWKS and independently verify every Sill-signed agent card and ARD ai-catalog.json trust manifest using off-the-shelf ed25519 tooling. No Sill SDK is involved.

Endpoint

Section titled “Endpoint”
GET https://edge.sill.so/.well-known/jwks.json
  • Content-Type: application/jwk-set+json; charset=utf-8 (RFC 7517 §8.5)
  • Cache-Control: public, max-age=300, s-maxage=300
  • CORS: Access-Control-Allow-Origin: * — the document is non-secret and intended to be fetched from any origin.

What it contains

Section titled “What it contains”

A single ed25519 public key for the edge card-signing key:

  • kty: OKP
  • crv: Ed25519
  • alg: EdDSA
  • use: sig
  • kid: foyer/edge/card-signing-v1
  • x: the base64url-encoded raw ed25519 public key (32 bytes)

This key signs both the per-site agent card and the per-site ARD trust manifest. They share a key by design — one public key, one verifier recipe, two signed surfaces.

Why a public JWKS

Section titled “Why a public JWKS”

Sill is a trust product. Anything Sill signs must be verifiable by parties who do not trust Sill’s word for it. The JWKS endpoint is what makes that possible:

  • Anyone can fetch it. No account, no API key.
  • It uses a standard format (RFC 7517) and a standard algorithm (RFC 8037).
  • A verifier needs no Sill code — only @noble/ed25519 / pynacl / tweetnacl / OpenSSL and an RFC 8785 (JCS) canonicalizer.

See also

Section titled “See also”