I have a JWT Class which generates JWT Token using Private key. Now, I need to expose an endpoint for exernal application to get the public key in the form of JWKS KeySet. Can anyone guide me how to achieve this scenario.

2 Answers 2


The JWKS is located based on a URL specified in OpenID Connect metadata. The discovery of OIDC metadata uses a special endpoint that Salesforce already provides out of the box and you won't be able to override it. Ship your public key to the other party via an out-of-band means or use Salesforce's out of the box support for issuing JWTs.


The Salesforce OpenID configuration exposes the JWKS information. Take this one as an example: https://de03-dev-ed.my.salesforce.com/.well-known/openid-configuration. Look for jwks_uri and follow that URL to https://de03-dev-ed.my.salesforce.com/id/keys. This will contain the key material you need.

  • The keys are only in RSA algorithm format
    – compski
    Apr 2, 2023 at 10:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .