Skip to main content

Public keys

Nopan signs every API response and every webhook with its private key. To verify those signatures, you need Nopan's corresponding public key. Each environment (sandbox and production) has its own set of signing keys, isolated between testing and production traffic.

You can find them in JSON Web Key Set (JWKS) format at standard .well-known paths:

You can also download them in PEM format for sandbox or production environments from Portal.

info

The kid field in each key matches the keyid value in Nopan's Signature-Input header — use it to select the correct key for verification.

Cache the key and refresh it at least every 24 hours.

Key rotation​

Nopan periodically rotates the signing keys used to sign API responses and webhooks.

During a key rotation:

  • A new public key is published in the JWKS before Nopan starts signing messages with it.
  • The previous and new keys may both be present in the JWKS during the transition period.
  • The keyid parameter in Signature-Input identifies the key used to sign the message.
Handle key rotation automatically

Your integration must support signing key rotation. Do not hardcode a signing key or key ID.

When verifying a signed message:

  • Cache the JWKS rather than fetching it for every message.
  • Select the verification key using the keyid from Signature-Input.
  • If the cached JWKS does not contain the referenced keyid, fetch the JWKS again and retry verification once before rejecting the message.
  • It is recommended to refresh the cached JWKS at least every 24 hours.

This allows your integration to continue verifying responses and webhooks when Nopan rotates its signing keys without requiring a deployment or configuration change.

For a step-by-step guide on how to use these keys to verify Nopan responses and webhooks, see Signed Message Validation.