<!-- llms.txt: https://workos.com/llms.txt -->

# Single Sign-On

The Single Sign-On API has been modeled to meet the [OAuth 2.0](https://workos.com/docs/glossary/oauth-2-0) framework specification. As a result, authentication flows constructed using the Single Sign-On API replicate the OAuth 2.0 protocol flow.

To automatically respond to changes in your SSO connections, use the [Connection events](https://workos.com/docs/events/connection).

## Get JWKS

Returns the JSON Web Key Set (JWKS) containing the public keys used for verifying access tokens.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/sso/jwks/client_01HXYZ123456789ABCDEFGHIJ"
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.user_management.get_jwks(client_id: "client_01HXYZ123456789ABCDEFGHIJ")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.user_management.get_jwks(client_id="client_01HXYZ123456789ABCDEFGHIJ")
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.UserManagement().GetJWKS(context.Background(), "client_01HXYZ123456789ABCDEFGHIJ")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->userManagement()
    ->getJwks(clientId: "client_01HXYZ123456789ABCDEFGHIJ");
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.userManagement.getJwks("client_01HXYZ123456789ABCDEFGHIJ");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.UserManagement.GetJwksAsync("client_01HXYZ123456789ABCDEFGHIJ");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .user_management()
        .get_jwks("client_01HXYZ123456789ABCDEFGHIJ")
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "keys": [
    {
      "alg": "RS256",
      "kty": "RSA",
      "use": "sig",
      "x5c": [
        "MIIDQjCCAiqgAwIBAgIGATz/FuLiMA0GCSqGSIb3DQEBCwUA..."
      ],
      "n": "0vx7agoebGc...eKnNs",
      "e": "AQAB",
      "kid": "key_01HXYZ123456789ABCDEFGHIJ",
      "x5t#S256": "ZjQzYjI0OT...NmNjU0"
    }
  ]
}
```

:::

### connection

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `object` | "connection" | Yes | Distinguishes the Connection object. |
| `id` | string | Yes | Unique identifier for the Connection. |
| `organization_id` | string | No | Unique identifier for the Organization in which the Connection resides. |
| `connection_type` | "Pending" \| "ADFSSAML" \| "AdpOidc" \| ... | Yes | The type of the SSO Connection used to authenticate the user. The Connection type may be used to dynamically generate authorization URLs. |
| `name` | string | Yes | A human-readable name for the Connection. This will most commonly be the organization's name. |
| `state` | "requires_type" \| "draft" \| "active" \| ... | Yes | Indicates whether a Connection is able to authenticate users. |
| `status` | "linked" \| "unlinked" | Yes | Deprecated. Use `state` instead. |
| `domains` | object[] | Yes | List of Organization Domains. |
| `created_at` | string | Yes | An ISO 8601 timestamp. |
| `updated_at` | string | Yes | An ISO 8601 timestamp. |

### GET /sso/jwks/{clientId}

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `clientId` | string | Yes | Identifies the application making the request to the WorkOS server. You can obtain your client ID from the [API Keys](https://dashboard.workos.com/api-keys) page in the dashboard. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `keys` | object[] | The public keys used for verifying access tokens. |