# Aurea's Institution Callback Keys

> Coming soon, upon request — this feature is turned on for your tenant by the Aurea team. [Contact us](https://www.aureahub.com/contact)

The public keys that verify the requests Aurea sends your institution callback.

## Overview

- A JSON Web Key Set (RFC 7517) of EC P-256 keys, `alg` `ES256`, `use` `sig`: `kid` is each key's RFC 7638 SHA-256 thumbprint, the `kid` of the requests it signs.
- The key in use first, then the next one, published before it signs anything. Match a request's `kid` to a key; read the set again when a `kid` is new to you.
- `{ "keys": [] }` while Aurea has no request key in place. `503` `INSTITUTION_CALLBACK_KEYS_UNAVAILABLE` when the keys cannot be read: keep the set you have and try again.
- Public, no authentication; `Cache-Control: public, max-age=300`. How to verify a request: [Institution Callback & Co-Signer](https://docs.aureahub.com/docs/guide-institution-callback.md).

## Endpoint

### `GET /v1/institution-callbacks/jwks.json`

Authentication: none (public endpoint).

The public keys of the institution callback requests.

**Responses**

`200` OK

```json
{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "x": "KuhTcuWfFP28aYbX-4QLEV9dvVvdpQsD75C9KW6Uz4M",
      "y": "gtfDgeQBmMokzLpzeCC0flnmnXtyMpKGgCl_JGmRrmo",
      "kid": "FjOvSORynPhxZSf9XiH0vDm_wabQB4Ek9DSkV7LhFyo",
      "alg": "ES256",
      "use": "sig"
    }
  ]
}
```

`200` No key yet

```json
{ "keys": [] }
```

`503` Unavailable

```json
{
  "statusCode": 503,
  "error": "ServiceUnavailableError",
  "message": "The institution callback keys could not be read. Try again later.",
  "details": { "code": "INSTITUTION_CALLBACK_KEYS_UNAVAILABLE" }
}
```

**Example request**

```bash
curl https://api.aureahub.com/v1/institution-callbacks/jwks.json
```

---

Web version: https://docs.aureahub.com/#institution-callback-jwks