Callback verification public key
Security
Callback Public Key
Returns the RSA public key used to sign outbound webhook notifications.
GET
Callback verification public key
Each webhook sent by winam-payments includes an
See Webhooks for the full signature verification flow with code examples in Python and Node.js.
X-Winam-Signature header — a JWT RS256 token signed with Winam’s private key. Use this endpoint to fetch the corresponding public key for verification.
Cache this response. The key rotates rarely — fetching it on every webhook is unnecessary overhead. A cache TTL of 24 hours is recommended.
Authorizations
Response
200 - application/json
Successful Response
JWT signing algorithm used for outbound webhooks
Example:
"RS256"
RSA/ECDSA public key in PEM format. Fetch once and cache — the key rotates rarely.
Key rotation identifier. Changes when the key pair is rotated.
Example:
"winam-payments-v1"

