Skip to main content

How to Host a Public JWKS

BENJI authentication uses a P-256 public/private key pair. Your private key remains with you and is used to sign authentication requests. The corresponding public key should be published as a JSON Web Key Set (JWKS) so Franklin Templeton's authentication service can retrieve the key and verify those signatures.

Hosting the public key gives you control over where the key is stored and how it is rotated. The hosted file must contain public key material only. Never publish the private JWK or its d value.

Technical details​

Endpoint location​

Host the JWKS at a publicly accessible HTTPS URL, reachable without authentication so BENJI's authentication service can retrieve the public key. A recommended structure is https://YOUR-DOMAIN/.well-known/keys.json. For example:

https://api.example.com/.well-known/keys.json

Response format​

The endpoint should return a JSON object containing a keys array. Each entry in the array is a public JSON Web Key (JWK).

For the P-256 authentication key generated during BENJI setup, the public JWK contains the following values:

  • kty — Key type. For BENJI authentication keys, this is EC.
  • crv — Elliptic curve. For BENJI authentication keys, this is P-256.
  • x — Public x-coordinate of the elliptic-curve key.
  • y — Public y-coordinate of the elliptic-curve key.
  • kid — Key identifier used to identify the corresponding signing key.
  • iat — Timestamp added by the BENJI key-generation example when the key pair is created.

The public JWK must not contain d. The d parameter is the private-key component and must remain private.

JWKS example​

A JWKS containing one BENJI authentication public key should look like this:

{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "x": "aBcDeFgHiJkLmNoPqRsTuVwXyZaBcDeFgHiJkLmNoPq",
      "y": "zYxWvUtSrQpOnMlKjIhGfEdCbAzYxWvUtSrQpOnM",
      "kid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
      "iat": 1234567890
    }
  ]
}

Key rotation​

A JWKS may contain more than one public key. This can be useful during a coordinated key rotation when both the existing and replacement public keys need to be available temporarily.

Each key must have its own unique kid so the authentication service can identify the correct public key for signature verification.

After rotation is complete and the previous key is no longer used for BENJI authentication, remove the old public key according to your organization's key-management and BENJI onboarding procedures.

Publish the JWKS​

How the file is hosted is up to your organization. You may use an existing web application, API gateway, static site, cloud storage service, or other HTTPS hosting platform that can expose a public JSON response.

The hosting implementation should ensure that:

  • the URL is publicly reachable over HTTPS
  • the response contains valid JSON
  • the top-level object contains a keys array
  • the expected kid is present
  • only public key material is exposed
  • the URL remains stable for the BENJI authentication configuration

BENJI does not require you to use a specific hosting provider.

Verify the endpoint​

After publishing the file, please ensure that the link displays the public key in browser. If the web page displays your JSON, setup is complete