Signing keys

Public clients verify tokens with the discovered jwks_uri or GET /api/oauth2/jwks. Cache JWKS according to HTTP semantics and refresh when a token references an unknown kid.

Administrative key operations require an admin-console token:

Method	Route	Purpose
GET	/api/v1/management/signing-keys	List keys with pagination.
POST	/api/v1/management/signing-keys	Generate a new signing key.
POST	/api/v1/management/signing-keys/{id}/activate	Make a key active for new signatures.

Activating a new key does not mean old public keys should disappear immediately. Existing tokens must remain verifiable through their validity window. Never expose private key material through client applications or logs.