Skip to main content
GET
Callback verification public key
Each webhook sent by winam-payments includes an X-Winam-Signature header — a JWT RS256 token signed with Winam’s private key. Use this endpoint to fetch the corresponding public key for verification.
Cache this response. The key rotates rarely — fetching it on every webhook is unnecessary overhead. A cache TTL of 24 hours is recommended.
See Webhooks for the full signature verification flow with code examples in Python and Node.js.

Authorizations

X-API-Key
string
header
required

Response

200 - application/json

Successful Response

algorithm
string
required

JWT signing algorithm used for outbound webhooks

Example:

"RS256"

public_key_pem
string
required

RSA/ECDSA public key in PEM format. Fetch once and cache — the key rotates rarely.

key_id
string
required

Key rotation identifier. Changes when the key pair is rotated.

Example:

"winam-payments-v1"