type: object
description: |
    RFC 7517 JWK Set — the public keys used to verify access / refresh
    tokens issued by `/oauth/token`.
required: [keys]
properties:
    keys:
        type: array
        items:
            type: object
            description: A single JWK. Shape depends on `kty`.
            required: [kty, kid]
            properties:
                kty:
                    type: string
                    description: "Key type — typically `RSA` or `EC`."
                kid:
                    type: string
                    description: "Key id — referenced from the `kid` JWT header."
                use:
                    type: string
                    description: "Key use — typically `sig`."
                alg: { type: string }
                n:
                    type: string
                    description: "RSA modulus (when `kty=RSA`)."
                e:
                    type: string
                    description: "RSA exponent (when `kty=RSA`)."
                crv:
                    type: string
                    description: "EC curve (when `kty=EC`)."
                x: { type: string }
                y: { type: string }
            additionalProperties: true
example:
    keys:
        - kty: RSA
          kid: key-1
          use: sig
          alg: RS256
          n: "0vx7agoebGcQSuuPiLJX…"
          e: AQAB
